Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Username enumeration via response timing: not getting response using repeater with X-Forwarded-For

Herbert | Last updated: Aug 07, 2021 02:34PM UTC

Hey guys, I'm working on "enumeration via response timing" lab, when I'm using repeater to send an X-Forwarded-For I'm not getting response, this is my request: POST /login HTTP/1.1 Host: ace11f691fef2ad580c703dd004a00c5.web-security-academy.net Connection: close Content-Length: 33 Cache-Control: max-age=0 sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Google Chrome";v="92" sec-ch-ua-mobile: ?0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36 Origin: https://ace11f691fef2ad580c703dd004a00c5.web-security-academy.net Content-Type: application/x-www-form-urlencoded Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://ace11f691fef2ad580c703dd004a00c5.web-security-academy.net/login Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: session=6jSvJpIgS6Oyz5v3haB4OZvwJpprt9Jr X-Forwarded-For: 501 username=chivo01&password=chivo01 I'm following Michael Sommer's walk through and he got response, any recommendations?

Ben, PortSwigger Agent | Last updated: Aug 09, 2021 10:40AM UTC