The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Bypassing GraphQL brute force protections

Surprises | Last updated: Mar 29, 2024 02:19AM UTC

Hi, you have Bug in the brute force to GraphQL, I did it right and the payload is correct but still I getting a message of: HTTP/2 200 OK Content-Type: application/json; charset=utf-8 X-Frame-Options: SAMEORIGIN Content-Length: 108 { "errors": [ { "locations": [], "message": "Unknown operation named 'login'." } ] } br, Surprises

Surprises | Last updated: Mar 29, 2024 02:21AM UTC

payload example: mutation { bruteforce0:login(input:{password: "123456", username: "carlos"}) { token success }

Dominyque, PortSwigger Agent | Last updated: Mar 29, 2024 07:48AM UTC