More Complex Intruder Attacks with Burp!

This write-up details an external penetration test targeting a firewall's browser-based SSL VPN: the author reverse-engineers the login JavaScript (which builds a CHAP-style MD5 digest from form values and the password), extracts the logic locally, and integrates it into Burp Intruder via a custom external command to automate password-spray and brute-force attacks while describing operational trade-offs and session handling considerations.