Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

unclear lab instructions

tekko | Last updated: Jun 18, 2020 05:44PM UTC

IN the lab: Username enumeration via response timing, I find the instruction #2 difficult to understand. It says: #2. Identify that the X-Forwarded-For header is supported, which allows you to spoof your IP address and bypass the IP-based brute-force protection. How and where do I identify that the X-Forwarded-for header is supported?

Ben, PortSwigger Agent | Last updated: Jun 18, 2020 06:15PM UTC

Hi Steve, We included a tip in the lab description that the HTTP request headers may need manipulating to get around the IP-based brute-force protection. The labs are intended to be challenging and to get progressively more difficult, so research and experience will definitely help in completing them. We try to get them to simulate vulnerabilities that you might find when actually testing a site.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.