Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Username enumeration via response timing (Authentication) -> X-Forwarded-For

Habeeb | Last updated: Mar 02, 2023 07:36PM UTC

Hello, While working on username enumeration via response timing lab, I used HTTP header "X-Forwarded-For" to spoof my IP address in order to bypass the IP-based brute-force protection with Repeater but I kept getting this error: HTTP/1.1 400 Bad Request Content-Type: application/json; charset=utf-8 Connection: close Content-Length: 16 "Protocol error" I utilized this syntax -> X-Forwarded-For: <client>, <proxy> Also, I did some googling and found that the modified version of the HTTP X-Forwarded-For is HTTP Forwarded header. I tried that too but it still outputted the same error above. Thanks in advance.

Ben, PortSwigger Agent | Last updated: Mar 03, 2023 07:59AM UTC

Hi Habeeb, The video solution should help you here - you should just be able to enter a number value for this header (if you note the Intruder part of the solution we suggest setting up an attack that cycles through the number range from 1 to 100).

Habeeb | Last updated: Mar 03, 2023 10:11AM UTC