> For the complete documentation index, see [llms.txt](https://cas-cyber.gitbook.io/cas-cybersecurity/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cas-cyber.gitbook.io/cas-cybersecurity/web-application-security/dvwa/dvwa-exercises-1.md). # DVWA Exercises 1 ### 01. Bruteforce Attack 1 Login with admin / admin In burp click on forward until you see the post request. Hit **Ctrl + i** to send it to the Intruder tab

Goto Intruder, choose Cluster bomb as Attack type. Clear all variables and add the value of username and the value of password. For both we want to provide a wordlist. ![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MfT0VPyK6X13Egd9pzy%2F-MhjYGcI9EpQ9DesSmHp%2F-MhjrQoT2_xUZ-sW83hl%2Fburp05.png?alt=media\&token=8a2ccf5e-d553-4b59-b1df-56265fa1255e) Generate passwordlist: > gunzip /usr/share/wordlist/rockyou.txt.gz > > head -20 rockyou.txt >passwords.txt ![Generating a small password list](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MfT0VPyK6X13Egd9pzy%2F-MhjYGcI9EpQ9DesSmHp%2F-MhjulYhcfYRHY0MrXsN%2Fpassword_list.png?alt=media\&token=86bcc8e3-6783-475c-89d0-5ea30a772e99) For payload 1 I'll add 4 usernames

For payload 2 I'll load the password list

Start the attack and check Response header

### 02. Bruteforce Attack 2 Let's login with admin / password and solve the bruteforce exercise

submit wrong credentials admin / test and fire up the intruder modul

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MfT0VPyK6X13Egd9pzy%2F-Mhk-mT1ea-yidelb7Kv%2F-Mhk4Q8AMq0iA_yc-gBy%2Fburp11.png?alt=media\&token=4c3138c0-2a2a-4799-b2de-9906e3324e16) Set the payload and start the attack

Check content length