The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Bypassing brute force protection - Graphql

Shreenivas | Last updated: Oct 28, 2023 04:42PM UTC

Hi, I am getting invalid json for this lab (https://portswigger.net/web-security/graphql/lab-graphql-brute-force-protection-bypass), here is a sample JSON for POST /graphql/v1 endpoint. mutation {bruteforce0:login(input:{password: "123456", username: "carlos"}) { token \n success}bruteforce1:login(input:{password: "password", username: "carlos"}) { token \n success}} I followed what was mentioned in the solution, still the issue. Regards,

Shreenivas | Last updated: Oct 28, 2023 05:12PM UTC

I solved it, ignore the above post.

Michelle, PortSwigger Agent | Last updated: Oct 30, 2023 09:35AM UTC