Using Burp Suite and DVWA website:

Change your security level to Medium. In the DVWA website, find a user name (NOT user id which is a numeric value) list using SQL injection attack. The user name is not necessarily the same as users first name or last name. Using brute force attack through the Burp Suite tool, find a plain password for each user name. The password list (pass.txt) is given in the Canvas. Capture the screen that shows user name in the DVWA website using SQL injection and add to the report. Capture the screen that shows user name and corresponding password in the Burp Suite and add to the report. Add the screen shots after you successfully logged in with all the found user name and password in the DVWA website. Explain how you identified the passwords of the user from the Burp Suite tool.

Using brute force attack through the Burp Suite tool, find a password for each user name. (Show code)

The password list (pass.txt) (you may turn into txt file):

----------

23456 12345678 qwerty 123456789 12345 1234 111111 1234567 dragon 123123 baseball abc123 football monkey letmein 696969 shadow master 666666 qwertyuiop 123321 qazwsx 123qwe charlie robert thomas hockey ranger q1w2e3r4t5 orange 11111 charley golfer peanut arsenal eagles melissa boomer booboo spider nascar monster tigers yellow xxxxxx 123123123 gateway marina diablo bulldog qwer1234 compaq purple hardcore

banana junior hannah 123654 porsche lakers iceman money cowboys 987654 london tennis 999999 ncc1701 coffee scooby 0000 miller boston password dakota dakota q1w2e3r4 natasha 1q2w3e4r jasmine golden canada sophie Password apples d!ck [note the '!' is replaced with an 'I' but chegg does not allow profanity] razz 123abc pokemon qwaszx jonathan liverpoo david danielle 159357 jackie 1990 123456a 789456 turtle