Testing for authentication via Burp

This topic primarily talks about trying to brute force authentication pages in case rate limiting is not put into place. We will be learning how we can use Burp on various login pages to try and brute force the authentication with a set of username and password dictionaries. Lastly, we will also check if the authentication page is vulnerable to SQL injection. 

Brute forcing login pages using Burp Intruder

Let us not waste time and quickly head on to a few of the applications to see how we can use Burp to brute force credentials on authentication pages. The first application we will brute force is OrangeHRM in the OWASP BWA list. 

Once you open the app, you will be shown a login...