# Username and Password Bruteforcing with BurpSuite

In authentication sites, like login pages, we can use [_Burp Suite_](../../tools-and-utilities#burp-suite) to make a brute-force attack using dictionaries or well-known usernames and passwords.

* Intercept a petition to the target endpoint using the _Proxy_ tab, right-click the petition, and hit _Send to Intruder_

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fb7P6bo8iJafncEbDMXtW%2Fimage.png?alt=media&#x26;token=d24eb71d-533e-4422-88ae-28a059874e81" alt=""><figcaption></figcaption></figure>

***

* Go to the _Intruder_ tab, then select the target field to be changed and hit the _Add_ button

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FtbPD4pAvk0ePOlE56XT3%2Fimage.png?alt=media&#x26;token=b2792840-8545-4e6d-ac1e-4feb4138aad3" alt=""><figcaption></figcaption></figure>

***

* Check that the desired field is surrounded by symbols which means it has been selected properly. Then in the right pane,l add the desired payloads, and hit the _Start Attack_ button on top

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FGZOQjRlqeEZaFMtaYguD%2Fimage.png?alt=media&#x26;token=99b84ffd-d672-44e0-91f4-158affab97fc" alt=""><figcaption></figcaption></figure>

***

* Another window will be displayed with the petitions and their values. Here, the results can be compared to check if we receive different responses, the length of them, or other interesting values

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FAY70QGJHe7fVsypIOHYV%2Fimage.png?alt=media&#x26;token=a601c7b3-db06-4448-b625-670f26d4c77a" alt=""><figcaption></figcaption></figure>
