Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Request

AbdulRahman | Last updated: Feb 21, 2022 09:05PM UTC

Hello , I want to do something every (number) of requests , e.g. I want every 6 request to set the username parameter to " test " how should I do it ? - Burp suite pro version :) <----

Michelle, PortSwigger Agent | Last updated: Feb 22, 2022 10:51AM UTC

Thanks for your message. Can you describe your scenario in a bit more detail, please? Which tool are you using within Burp when you want to set the username parameter to test? Are you performing an intruder attack? What requests are being sent between these requests where the username parameter is set to test? If you'd prefer to share the details directly, feel free to email us using support@portswigger.net.

AbdulRahman | Last updated: Feb 23, 2022 01:41PM UTC

Scenario is that I'm using burp intruder , and the site is blocking every 3 failed login attempt so to bypass it I should make the 3rd login attempt success to bypass the block protraction , sooo ... is there any way in burp suite it self that do it for me or any recommended extensions? ( I want a way on burp suite not external ways cause I know some ) Like doing 2 requests with username I want to access his account and the last one is my account to bypass the block protraction e.g. POST /login HTTP ... bla bla 1- username=hackme&password=123 2- username=hackme&password=456 3- username=myvaildaccount&password=valid and repeat it over & over ...

Michelle, PortSwigger Agent | Last updated: Feb 24, 2022 01:54PM UTC

Thanks for the update. A Pitchfork attack as described and used in this lab in our Web Security Academy might help https://portswigger.net/web-security/authentication/password-based/lab-broken-bruteforce-protection-ip-block The payload list for your usernames would cycle through the two usernames, so using your example: hackme hackme myvalidaccount The payload list for the passwords would cycle through the passwords you wanted to test and your valid password, they would need to match up with the usernames, so using your example: 123 456 valid Please let us know if you have any further questions.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.