Burp Suite User Forum

Create new post

How to Debug Recorded Login Playback Capability

Philip | Last updated: Jan 08, 2021 10:44PM UTC

Hello, I'm running into some problems trying to get the very new Recorded Login capability to work with a web application. One issue I'm having is that when using the "Replay" button to debug a Recorded Login script, it doesn't fill in the login/password fields. After a few seconds, Burp kills the application window. Where do the errors about what failed go? Is there a troubleshooting or debug log kept somewhere? I noticed that uniqueElementID in the JSON changes on multiple login requests, not sure if that is causing the problem or not. It's weird because I have seen the recorded login work in a scan by inspecting page responses with Flow as part of a scan. Not sure if it broke, or if the Replay button which I think is new has some bugs in it. Also, when using a more complicated single page webapp, I'm running into the same bug that this person ran into: https://forum.portswigger.net/thread/failed-to-replay-recorded-login-sequences-eb4724e9

Uthman, PortSwigger Agent | Last updated: Jan 11, 2021 09:42AM UTC

Hi Philip, In terms of debugging, you should find some errors in the Event log and the Replay functionality is a good place to start so you are on the right track. It is best that our development team investigates this further for you. If possible, can you please send us the information below via email? You can reach us on support@portswigger.net - An HTML snippet of the login form - The login script (JSON) exactly as it is pasted into Burp - A screen recording of the login sequence replayed (please use the 'Replay' button – visible in Burp under Application Login when you select your recorded login sequence) - A screenshot of the Event log (if any errors are visible) - How many locations, if any, are found after logging in? - Does the application/site use a WAF? - Do you have any other extensions enabled? Are these required as part of the login process? E.g. Add Custom Header - Are there any popups in the login process? - Is an account lockout policy set up on the user account being used?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.