Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

ASP.NET forms authentication login redirect

Scott | Last updated: Aug 02, 2015 03:58PM UTC

Can Burp Suite support a login redirect where the login page is not within the scope? I have a /Employee and a /Customer area within my ASP.NET MVC application. For ease of development, the login URL in Web.config is /Customer/Account/Login. For our scanning requirements I would like to be able to use Carbonator and point it to /Employee/Home which is a landing page with links out to all the other parts of the /Employee area. Burp starts up, tries to hit the /Employee/Home page, sees the redirect to /Customer/Account/LogIn and stops there. Presumably this is because the /Customer area is not within the scope. Even when I have added it to the scope, it seems to ignore the fact that it was redirected there to serve the /Employee/Home request, and instead just begins attacking the /Customer/Account/Login url. Am I missing anything? I have configured the login username and password in scanner options to the correct information. Thanks

PortSwigger Agent | Last updated: Aug 10, 2015 10:48AM UTC