Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Username enumeration via response timing problems with X-Forwarded-For header

Daniel | Last updated: Nov 09, 2023 09:22AM UTC

Hello I am know how to solve the lab but most of the times when I pass the X-Forwarded-For:1 I have below request: POST /login HTTP/2 Host: asdsdasdasd.web-security-academy.net Cookie: session=asdasdasdasd Content-Length: 0 Cache-Control: max-age=0 Sec-Ch-Ua: "Chromium";v="119", "Not?A_Brand";v="24" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Linux" Upgrade-Insecure-Requests: 1 Origin: https://asdsdasdasd.web-security-academy.net Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://asdsdasdasd.web-security-academy.net/login Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 2 Username=carlos&password=123: I get following error: "Missing parameter" Can you help me out in the solution they using Connection: close before the line username. But I still face same results Thank you

Daniel | Last updated: Nov 09, 2023 09:23AM UTC

sorry the username looks like below: Username=carlos&password=123

Dominyque, PortSwigger Agent | Last updated: Nov 09, 2023 12:55PM UTC