Subject
brute-force
Lab: Username enumeration via response timing
Mind Palace
It is observed that the Cluster bomb of the Fuse module cannot be used to directly crack the account password by violence. Because there is a wait mechanism after multiple HTTP-POST requests are sent from the same IP address
The solution is as follows: X-Forwarded-For uses a different IP address to bypass the device
Step 1
Payload File
Step 2
Configure brute-Fore in BP’s Fuse module
When configuration is complete, click Start attck; When you’re done, filter to get username&Password
END (´ o ^ `) o