BurpSuite not doing intruder attack as expected

HTB Content Machines
1

Hey forum, im a bit stuck with BurpSuite intruder attack. Im working on the starting point box called oopsie. It hosts a website. Ive captured the HTTP GET which is:

GET /cdn-cgi/login/admin.php?content=accounts&id=1 HTTP/1.1

Then into the intruder module of Burp I have parameterized this:
GET /cdn-cgi/login/admin.php?content=accounts&id=§1§ HTTP/1.1

Set the payload options for simple list:
for i in ‘seq 1 100’; do echo $i; done

And enabled always follow redirections and process cookies in redirections.

When starting the attack I get:
"The community edition of burpsuite contains a demo version of burp intruder. Some functionality is disabled and attacks are throttled.

The attack starts but only returns one line where I am expecting it to brute force 100 lines of code.

Do I need to purchase the full version of have I done something wrong?

2

OK I figured it out… I was doing it wrong. The list of 1 to 100 needed to be generated outside of burpsuite then the simple list of 1 to 100 uploaded in plain text.

I was thinking that burpsuite would be smart enought to run this list for me :slight_smile:

3

I’m having an issue where it runs through all 100 lines but returns blank status, and blank length value. This has been set correctly below, I’ve double checked it a few times.
GET /cdn-cgi/login/admin.php?content=accounts&id=§1§ HTTP/1.1

I’ve made sure the redirections options were set and process cookies. For some reason the results just show up blank.

4

Figured it out. I put in proxy port as 8080 in the Target section, I had 8080 in my head when it needed to be 80.