Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Adding X-Forwarded-For to bypass IP based brute force protection

adithya | Last updated: Aug 18, 2020 08:46AM UTC

Hi, I am using the following request on the repeater on the authentication challenge (enumeration using timing response) : POST /login HTTP/1.1 Host: acaf1f021f283a268092b4c2004c008d.web-security-academy.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: https://acaf1f021f283a268092b4c2004c008d.web-security-academy.net/login Content-Type: application/x-www-form-urlencoded X-Forwarded-For:127.0.0.1 Content-Length: 66 Connection: close Cookie: session=z4VDyMjyIL1hiZkh1J78iceO9t4VndLw Upgrade-Insecure-Requests: 1 csrf=2hCS8v3SGzAz9gWhsu7XyB3GpCi6AKvo&username=adada&password=dada Even though I have added the X-Forwarded-For header I still face the " You have made too many incorrect login attempts. Please try again in 30 minute(s)." error after 3 tries. Please let me know where I am going wrong.

Ben, PortSwigger Agent | Last updated: Aug 19, 2020 10:16AM UTC

Hi, You need to use the X-Forwarded-For header to bypass the IP based brute force protection. If you specify an actual IP address here then you will encounter the same issue with getting locked out after too many incorrect login attempts. The following video might help you with this lab: https://www.youtube.com/watch?v=DDgYWol15QE

Hafenecker | Last updated: Sep 21, 2021 01:16PM UTC

Hi, I am struggling with the same issue. Whatever value for the X-Forwarded-For header i am using I am getting the too many attempts message directly at the first attempt. The posted video is not availably any more but i am doing the same as shown in the video of the lab solution. Does there exist some other pitfalls? Here my request: POST /login HTTP/1.1 Host: acee1fd11e33189c808969e9004e0047.web-security-academy.net Cookie: session=a0xZl7llfq5cyL3y383PXn6ZAs4b2mvm User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 32 Origin: https://acee1fd11e33189c808969e9004e0047.web-security-academy.net Referer: https://acee1fd11e33189c808969e9004e0047.web-security-academy.net/login Upgrade-Insecure-Requests: 1 Te: trailers Connection: close X-Forwarded-For: 15 username=hrszj&password=wztjtu

Ben, PortSwigger Agent | Last updated: Sep 22, 2021 08:32AM UTC

Hi Lukas, Just to clarify, what stage of the solution are you having issues with?

Hafenecker | Last updated: Sep 22, 2021 11:00AM UTC

Hi Ben, I am struggeling at Step 2 or 2:00 of the Video Solution. When setting the X-Forwarded-For header (and chanching the value for each request) i am still running into the IP Block and get the "You have made too many incorrect login attempts. Please try again in 30 minute(s)." response after 3 requests.

Ben, PortSwigger Agent | Last updated: Sep 23, 2021 09:13AM UTC

Hi Lukas, I have just run through this particular lab and was able to solve it using the solution provided so it looks like it is working as expected. Just to clarify your last point there - are you saying that you are changing the value in the X-Forwarded-For header for each request you make when you are testing this in Repeater and are still seeing the 'too many login attempts' message after 3 requests (which would not be expected behaviour and is not something I have been able to replicate)? If the above is correct, is it possible for you to create a video for us (or at least a series of screenshots) showing your process and send this via email to support@portswigger.net so that we can see exactly the steps that you are following?

Hafenecker | Last updated: Sep 23, 2021 12:16PM UTC

Hi Ben, yes. I sent a mail with the video recording. Thank you.

Ben, PortSwigger Agent | Last updated: Sep 23, 2021 01:00PM UTC

Thanks Lukas. We have received your email so will take a look and respond from there.

Homayoon | Last updated: Dec 13, 2022 07:45AM UTC

Hi dear i have same issue

Ben, PortSwigger Agent | Last updated: Dec 13, 2022 11:33AM UTC

Hi, Are you able to provide us with some specific details of what issues you are encountering and what steps you have taken to try and solve this lab so that we can assist you further?

louis | Last updated: Jan 12, 2023 03:33PM UTC

Hi Ben i have same issue

louis | Last updated: Jan 12, 2023 03:34PM UTC

Whatever value for the X-Forwarded-For header i am using I am getting the too many attempts message directly at the first attempt.

Ben, PortSwigger Agent | Last updated: Jan 13, 2023 08:41AM UTC

Hi, Are you able to provide us with some specific details of what steps you have taken to solve this lab? If it is easier to do this with screenshots then please feel free to send us an email at support@portswigger.net.

Dilip | Last updated: Mar 14, 2024 12:01PM UTC

Hi Ben even I have same issues. I added X-Forwarded-For header and I tried Pitchfork attack with payloads as numbers for "X-Forwarded-For" and usernames given for username field but, still it says too many requests try after 30 mins.

Ben, PortSwigger Agent | Last updated: Mar 15, 2024 07:50AM UTC

Hi Dilip, Can you also send us an email at support@portswigger.net and include some screenshots of exactly what you are doing and what you are seeing so that we can take a further look into this for you?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.