Brute force email in JSON format

Question

I have a parameter

args=[490114,{"user_login":"user@example.com","":"","perm":"view","partners":[],"event_labels":[]}] 

in the HTTP request but in the encoded format.

I want to brute force this email using burpsuite but i get error code 400 bad request. The reproducible steps are:

1. I intercept the request with burpsuite and send the parameters (args) to intruder and choose only it
2. I copy and paste the payload several times changing only the email value in the payload (to test the operation)
3. Launch the attack

But I get error code 400 bad request. I don't know why.

Answer 1

The Error Code 400 means that the request was malformed. This means the request sent by the client(you, using burpsuite) to the server didn't fit the 'rules' of http.

In the case of a REST API with a JSON payload, 400's are typically used to indicate that the JSON is invalid in some way according to the API specification for the service. Which you didn't supply in your question. Maybe if you give some more information, i can answer more detailed. Meanwhile i suppose that the 400 is correct behavior indicating that this request is malformed in some unspecific way. I think 400 is the intended response for a nonexistent email in this JSON-request.