Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Login to post

Username enumeration via response timing (Authentication) -> X-Forwarded-For

Habeeb | Last updated: Mar 02, 2023 07:36PM UTC

Hello, While working on username enumeration via response timing lab, I used HTTP header "X-Forwarded-For" to spoof my IP address in order to bypass the IP-based brute-force protection with Repeater but I kept getting this error: HTTP/1.1 400 Bad Request Content-Type: application/json; charset=utf-8 Connection: close Content-Length: 16 "Protocol error" I utilized this syntax -> X-Forwarded-For: <client>, <proxy> Also, I did some googling and found that the modified version of the HTTP X-Forwarded-For is HTTP Forwarded header. I tried that too but it still outputted the same error above. Thanks in advance.

Ben, PortSwigger Agent | Last updated: Mar 03, 2023 07:59AM UTC

Hi Habeeb, The video solution should help you here - you should just be able to enter a number value for this header (if you note the Intruder part of the solution we suggest setting up an attack that cycles through the number range from 1 to 100).

Habeeb | Last updated: Mar 03, 2023 10:11AM UTC

Hello Ben, I followed the video solution and got the same error I indicated in the first post, however, I will try again and see if the error is from my end. Thank you for your assistance.

You need to Log in to post a reply. Or register here, for free.