Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Authenticate in web app for scanner/intruder

Marcus | Last updated: Feb 24, 2020 08:45PM UTC

We recently acquired license for Burp Suite Pro and I am trying to scan a web application and I keep seeing the errors "authentication failure" from the scan tasks and from Intruder I get "failed to connect" errors. I know the credentials are correct because I have manually tested them. Considering the web page utilizes javascript, I have tried enabling the experimental crawling option of using the embedded browser for navigation, but it returned the usual error "authentication failure from <domain>.org I have tried going through sessions > macros and using the intercepted http POST with the correct login credentials (the packet that returned http code 200:OK) to set up a macro with the credentials to automatically login if the session expires. Everything I do returns the same errors it seems, it always says authentication failure and usually says "java.net SocketException: Connection reset" I'm hoping I can get some advice on the next steps I should take to resolve this issue please, we need the full functionality of this product to work. Thanks

Hannah, PortSwigger Agent | Last updated: Feb 25, 2020 09:55AM UTC

Hi Would you be able to provide us with a copy of your diagnostic information? You can find this under "Help > Diagnostics". Could you also provide me with some more information on the errors you are seeing? More specifically, the source and message, and the functionality you were doing at the time the messages were triggered (e.g. running an automated scan, browsing using the proxy etc)

Marcus | Last updated: Feb 25, 2020 02:48PM UTC

Okay here is the diagnostic information awt.toolkit sun.awt.windows.WToolkit exe4j.consoleCodepage cp0 exe4j.isInstall4j true exe4j.launchName C:\Users\Mvandeven\AppData\Local\BurpSuitePro\BurpSuitePro.exe exe4j.moduleName C:\Users\Mvandeven\AppData\Local\BurpSuitePro\BurpSuitePro.exe exe4j.semaphoreName Local\c:_users_mvandeven_appdata_local_burpsuitepro_burpsuitepro.exe0 exe4j.tempDir exe4j.unextractedPosition 0 file.encoding Cp1252 file.separator \ install4j.appDir C:\Users\Mvandeven\AppData\Local\BurpSuitePro\ install4j.exeDir C:\Users\Mvandeven\AppData\Local\BurpSuitePro\ install4j.launcherId 70 install4j.swt false java.awt.graphicsenv sun.awt.Win32GraphicsEnvironment java.class.path C:\Users\Mvandeven\AppData\Local\BurpSuitePro\.install4j\i4jruntime.jar;C:\Users\Mvandeven\AppData\Local\BurpSuitePro\.\burpsuite_pro.jar java.class.version 56.0 java.home c:\users\mvandeven\appdata\local\burpsuitepro\jre java.io.tmpdir C:\Users\MVANDE~1\AppData\Local\Temp\ java.library.path c:\users\mvandeven\appdata\local\burpsuitepro\jre\bin;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Sennheiser\SoftphoneSDK\;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Sennheiser\SoftphoneSDK\;C:\Users\Mvandeven\AppData\Local\Microsoft\WindowsApps;;C:\Users\Mvandeven\Downloads\sonar-scanner-4.1.0.1829-windows\bin java.runtime.name OpenJDK Runtime Environment java.runtime.version 12.0.2+10 java.specification.name Java Platform API Specification java.specification.vendor Oracle Corporation java.specification.version 12 java.vendor Oracle Corporation java.vendor.url https://java.oracle.com/ java.vendor.url.bug https://bugreport.java.com/bugreport/ java.version 12.0.2 java.version.date 2019-07-16 java.vm.compressedOopsMode Zero based java.vm.info mixed mode java.vm.name OpenJDK 64-Bit Server VM java.vm.specification.name Java Virtual Machine Specification java.vm.specification.vendor Oracle Corporation java.vm.specification.version 12 java.vm.vendor Oracle Corporation java.vm.version 12.0.2+10 jdk.debug release jdk.tls.allowUnsafeServerCertChange true jdk.tls.server.protocols TLSv1,TLSv1.1,TLSv1.2 org.bouncycastle.jsse.client.dh.minimumPrimeBits 1024 org.bouncycastle.jsse.client.dh.unrestrictedGroups true os.arch amd64 os.name Windows 10 os.version 10.0 path.separator ; sun.arch.data.model 64 sun.awt.enableExtraMouseButtons true sun.boot.library.path c:\users\mvandeven\appdata\local\burpsuitepro\jre\bin sun.cpu.endian little sun.cpu.isalist amd64 sun.desktop windows sun.io.unicode.encoding UnicodeLittle sun.java.command C:\Users\Mvandeven\AppData\Local\BurpSuitePro\BurpSuitePro.exe sun.jnu.encoding Cp1252 sun.management.compiler HotSpot 64-Bit Tiered Compilers sun.os.patch.level user.country US user.dir C:\Users\Mvandeven\AppData\Local\BurpSuitePro user.home C:\Users\Mvandeven user.language en user.name MVanDeven user.script user.timezone America/New_York user.variant Burp Version 2020.1 Burp Browser Version 0.144 Burp Browser binaries C:\Users\Mvandeven\AppData\Local\BurpSuitePro\burpbrowser\0.144 Code source C:\Users\Mvandeven\AppData\Local\BurpSuitePro\burpsuite_pro.jar Debug ID 8d5k6hg8zgk5bkuusndz:q2ef JAR type Installer USERDOMAIN_ROAMINGPROFILE MLSEL OneDriveCommercial C:\Users\Mvandeven\OneDrive - Maple Leaf Sports & Entertainment Ltd LOCALAPPDATA C:\Users\Mvandeven\AppData\Local PROCESSOR_LEVEL 6 USERDOMAIN MLSEL FPS_BROWSER_APP_PROFILE_STRING Internet Explorer LOGONSERVER \\WSC1-INT-01 SESSIONNAME Console ALLUSERSPROFILE C:\ProgramData PROCESSOR_ARCHITECTURE AMD64 PSModulePath C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules SystemDrive C: OneDrive C:\Users\Mvandeven\OneDrive - Maple Leaf Sports & Entertainment Ltd APPDATA C:\Users\Mvandeven\AppData\Roaming USERNAME MVanDeven USERDNSDOMAIN INT.MLSEL.COM ProgramFiles(x86) C:\Program Files (x86) CommonProgramFiles C:\Program Files\Common Files Path c:\users\mvandeven\appdata\local\burpsuitepro\jre\bin;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Sennheiser\SoftphoneSDK\;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\Sennheiser\SoftphoneSDK\;C:\Users\Mvandeven\AppData\Local\Microsoft\WindowsApps;;C:\Users\Mvandeven\Downloads\sonar-scanner-4.1.0.1829-windows\bin FPS_BROWSER_USER_PROFILE_STRING Default PATHEXT .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC DriverData C:\Windows\System32\Drivers\DriverData OS Windows_NT COMPUTERNAME WCN1C4200 PROCESSOR_REVISION 4e03 CommonProgramW6432 C:\Program Files\Common Files HOMESHARE \\int.mlsel.com\1\home\MVanDeven ComSpec C:\WINDOWS\system32\cmd.exe UATDATA C:\WINDOWS\CCM\UATData\D9F8C395-CAB8-491d-B8AC-179A1FE1BE77 ProgramData C:\ProgramData ProgramW6432 C:\Program Files HOMEPATH \ SystemRoot C:\WINDOWS TEMP C:\Users\MVANDE~1\AppData\Local\Temp HOMEDRIVE Z: PROCESSOR_IDENTIFIER Intel64 Family 6 Model 78 Stepping 3, GenuineIntel USERPROFILE C:\Users\Mvandeven TMP C:\Users\MVANDE~1\AppData\Local\Temp CommonProgramFiles(x86) C:\Program Files (x86)\Common Files ProgramFiles C:\Program Files PUBLIC C:\Users\Public NUMBER_OF_PROCESSORS 4 windir C:\WINDOWS =:: ::\ Total memory 663,748,608 Max memory 3,980,394,496 Free memory 422,070,848 Number of processors 4 As far as the errors go, right now I am seeing "Authentication failure from <domain>" and "java.net.SocketException: Connection reset" both errors coming from Task 3 which is the scan I set up to use the embedded browser. When I try directory traversal fuzzing with Intruder, the Intruder sends an error that just says "Failed to connect to <domain>" and I also get errors from Proxy that say "No route to host: connect" and "java.net.NoRouteToHostException: No route to host: connect"

Hannah, PortSwigger Agent | Last updated: Feb 25, 2020 04:03PM UTC

Thank you for that information. Have you tried changing any of your TLS negotiation settings? This can be found under "Project options > TLS > TLS negotiation". Are you able to send requests to the URL using the Repeater, and are you able to browse to the website normally?

Marcus | Last updated: Feb 25, 2020 04:15PM UTC

Yes I can browse the website normally, the proxy can pick up the traffic. I sent the http POST request with the credentials to the Burp repeater and I was able to get the http response with code 200: OK So I believe the repeater works. I have not tried changing any TLS negotiation settings, what setting should I have selected?

Hannah, PortSwigger Agent | Last updated: Feb 25, 2020 04:31PM UTC

If you try selecting "Custom protocols and ciphers" and then set it to match the protocols and ciphers used at the URL, that should be a good starting point. You could also try "Allow unsafe renegotiation" and see if that makes any difference.

Marcus | Last updated: Feb 25, 2020 04:49PM UTC

I have tried custom protocols and ciphers, and allow unsafe renegotiation. I'm still getting the same error. In the scan task window, I can see a Debug message in the event log that says "did not find a login form" but when I navigate to the site manually, it redirects me to the login form. I have also tried adding a session handling rule to check if the session is valid, and a macro with the correct credentials to automatically log back in to invalid sessions, but I still get the same error.

Hannah, PortSwigger Agent | Last updated: Feb 26, 2020 11:46AM UTC

Is your installation configured to understand redirects? You can find this setting under "Project options > HTTP > Redirections". When scanning, are you using the default configurations or custom ones? If you are using custom configurations, could you tell me what your configuration details are? Have you tried using the sessions tracer to work out why your macro is not allowing you to automatically log back in to your session?

Marcus | Last updated: Feb 26, 2020 03:35PM UTC

Hi, I really appreciate all your help. I have since gone through the HTTP redirection settings and enabled JavaScript driven as well as any status code with location header, but I am still failing to authenticate. I have tried using session tracer like you said, and it doesn't seem to be redirected to the <domain>/login page. That is, I can't see the login page come up at all in the sessions tracer. For the scan I am using crawl and audit, within the scan configuration I am using new > crawling > misc > enabled embedded browser, and under the application login I have added the credentials which I have tested for the login form.

Hannah, PortSwigger Agent | Last updated: Feb 26, 2020 04:23PM UTC