In this lesson, we are going to understand about the
third fuzzing technique, which is known
as battering ram.
So what is battering ram?
This fuzzing technique only supplies or
only supports a single payload set.
When you supply that payload using a word list,
it uses the same payload for all the positions that
have been added in our custom template.
So it is the Practical time and let's see
how you can use the technique which is battering ram.
So you can see over here. I have written a yml
template which is a nuclei template named
as fuzzing underscore battering ram
dot. Yml, which can also be
seen in the ID block. This is the information block. Let's
see the request block. This is
a HTTP raw request.
We can see over here.
This is a post request here as we
are using a battering ram fuzzing Technique.
We can only specify one payload position.
So let's assume I already know the username for
this web application. The username is
admin. I don't know the password. So I'm
going to specify a parameter underscore a
over here.
And rest are the headers.
You can also see the host has been supplied to the host name.
Let's scroll down to the payloads part in the
payloads block. We can see we have supplied and
said parameter a is password.txt
word list which means each
password from the word list should be
replaced automatically at this position, which is
parameter a and we have said already that parameter
a is the value of the password parameter.
The matches condition Remains the Same that
we want to match success as a word
in the body and we also want to match and Status
which is 200, okay.
So let's run this template and let us see the output
so I'm going to go to my terminal quickly.
And I'm going to specify battering ram Dot. Yml.
I'm also going to specify hyphen V.
To show what exactly is happening behind?
You can see over here the first request contains
the username as admin and password as
demo.
The second password is Tomcat. The third password
is hackedify for this password. And so
on here in this specific request. We
are able to successfully identify the correct username
that we already knew and supplied but
the password was found using fuzzing
technique using this specific technique
and you can see the parameter a equals to
admin is the correct one and hence. We
are able to get this output.
You can also examine the same thing.
In these requests as
well. You can see this is the specific request
that was sent in which the admin username
was already known and was
hardcoded in the template, but we first for this
specific position, which is password equals
to and we successfully got a success
message.
So I hope you guys understood that how you can
use battering ram fuzzing technique to
First Target. Thank you.