> For the complete documentation index, see [llms.txt](https://itrp19-notes.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itrp19-notes.gitbook.io/notes/reference/hacking/burp/setting-up-macro-for-intruder.md).

# Setting up Macro for intruder

The provided text describes an advanced credential-stuffing attack using Burp Suite's Intruder and Macro functionalities. To execute this, follow these instructions:

**Setting Up the Request Capture:**

1. Start by capturing a login request to `http://10.10.129.2/admin/login/`.
2. Note the response, especially the session cookie and CSRF token, which are dynamic.

**Configuring the Intruder:**

1. With the Burp Proxy, intercept and capture the login request.
2. In Intruder, set up the attack:
   * Use the "Pitchfork" attack type.
   * Only select the username and password fields, leaving the session cookie and CSRF token fields unselected.

**Loading Payloads:**

1. Go to the Payloads tab in Intruder.
2. Load your username and password wordlists.

**Setting Up the Macro:**

<figure><img src="/files/PJNl9Y4mzESCoAZjA8YZ" alt=""><figcaption></figcaption></figure>

1. Navigate to the "Settings" tab and select "Sessions".
2. Under "Macros," add a new macro.

   * Choose a GET request to `http://10.10.129.2/admin/login/` from your history.
   * Name the macro appropriately.

   <figure><img src="/files/hSjaH2A4tPRI2abQtvyX" alt=""><figcaption></figcaption></figure>

   <figure><img src="/files/Nmfgoq2gW1zYeHm4NYPD" alt=""><figcaption></figcaption></figure>

   <figure><img src="/files/S38h5w60kRNv5ZBII96W" alt=""><figcaption></figcaption></figure>

**Configuring Session Handling Rules:**

1. Under "Session Handling Rules," add a new rule.
2. In the Scope tab:
   * Enable only for Intruder.
   * Set URL scope to "Use suite scope" or define a custom scope for `http://10.10.129.2/`.
3. In the Details tab, under "Rule Actions":

   * Add the "Run a Macro" action.
   * Select the macro you created.

   <figure><img src="/files/vEUOwoCVBSRqOJn0Q9h1" alt=""><figcaption></figcaption></figure>

   * Specify to update only the "loginToken" parameter and the "session" cookie.

   <figure><img src="/files/MCyhVMaxcElehgG6svcO" alt=""><figcaption></figcaption></figure>

**Launching the Attack:**

1. Return to Intruder and start the attack.
2. Monitor for 302 status code responses; 403 errors indicate a problem with the macro.
3. Sort responses by length to identify successful login attempts, which should be notably shorter

<figure><img src="/files/4TVp6AT6hVKKkx727upn" alt=""><figcaption></figcaption></figure>

This lab Credit goes to Try Hack Me on Burp Intruder Page TASK 12: The Extra Mile.