many timessecurity comes down to one thinguser passwords it' sad but true making things worsewhen it comes to web applicationsespecially custom onesit' all too common to find that account lockouts aren' implemented in other instancesstrong passwords are not enforced in these casesan online password guessing session like the one in the last might be just the ticket to gain access to the site the trick to online password guessing is getting the right wordlist you can' test million passwords if you're in hurryso you need to be able to create wordlist targeted to the site in question of coursethere are scripts in the kali linux distribution that crawl website and generate wordlist based on site content though if you've already used burp spider to crawl the sitewhy send more traffic just to generate wordlistplusthose scripts usually have ton of command-line arguments to remember if you're anything like meyou've already memorized enough command-line arguments to impress your friendsso let' make burp do the heavy lifting open bhp_wordlist py and knock out this code from burp import iburpextender from burp import icontextmenufactory from javax swing import jmenuitem from java util import listarraylist from java net import url import re from datetime import datetime from htmlparser import htmlparser class tagstripper(htmlparser)def __init__(self)htmlparser __init__(selfself page_text [def handle_data(selfdata)self page_text append(datadef handle_comment(selfdata)self handle_data(datadef strip(selfhtml)self feed(htmlreturn join(self page_textclass burpextender(iburpextendericontextmenufactory)def registerextendercallbacks(selfcallbacks)self _callbacks callbacks self _helpers callbacks gethelpers(self context none self hosts set(start with something we know is common self wordlist set(["password"]we set up our extension callbacks setextensionname("bhp wordlist"callbacks registercontextmenufactory(selfreturn def createmenuitems(selfcontext_menu)self context context_menu menu_list arraylist(