Once we have a list of valid usernames for our target application, we can try a brute force attack, which tries all possible character combinations until a valid password is found. Brute force attacks are not feasible in web applications due to the enormous number of combinations and the response times between client and server.
A more realistic solution is a dictionary attack, which takes a reduced list of highly probable passwords and tries them with a valid username.
In this recipe, we will use Burp Suite Intruder to attempt a dictionary attack over a login page.
