I have a parameter

args=[490114,{"user_login":"[email protected]","":"","perm":"view","partners":[],"event_labels":[]}] 

in the HTTP request but in the encoded format.

I want to brute force this email using burpsuite but i get error code 400 bad request. The reproducible steps are:

  1. I intercept the request with burpsuite and send the parameters (args) to intruder and choose only it
  2. I copy and paste the payload several times changing only the email value in the payload (to test the operation)
  3. Launch the attack

But I get error code 400 bad request. I don't know why.

  • You mean that you want to brute force the username? There is no way we can help because we don't know what the target is doing with the information.
    – schroeder
    Commented Mar 6, 2017 at 17:40
  • It is only a bug bounty program for a certain company that i test and it isn't username credential by the mean of a login form . Commented Mar 6, 2017 at 18:00

1 Answer 1


The Error Code 400 means that the request was malformed. This means the request sent by the client(you, using burpsuite) to the server didn't fit the 'rules' of http.

In the case of a REST API with a JSON payload, 400's are typically used to indicate that the JSON is invalid in some way according to the API specification for the service. Which you didn't supply in your question. Maybe if you give some more information, i can answer more detailed. Meanwhile i suppose that the 400 is correct behavior indicating that this request is malformed in some unspecific way. I think 400 is the intended response for a nonexistent email in this JSON-request.

  • 1
    Thx you are right .The 400 error code is only for nonexistent email in the JSON Request Commented Mar 6, 2017 at 21:19
  • @MohamedOsama good to hear that it helped! can you accept my answer? greetings
    – Gewure
    Commented Mar 6, 2017 at 21:56
  • 1
    Done thx you again ! Commented Mar 6, 2017 at 23:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .