1

I have a parameter

args=[490114,{"user_login":"user@example.com","":"","perm":"view","partners":[],"event_labels":[]}] 

in the HTTP request but in the encoded format.

I want to brute force this email using burpsuite but i get error code 400 bad request. The reproducible steps are:

  1. I intercept the request with burpsuite and send the parameters (args) to intruder and choose only it
  2. I copy and paste the payload several times changing only the email value in the payload (to test the operation)
  3. Launch the attack

But I get error code 400 bad request. I don't know why.

  • You mean that you want to brute force the username? There is no way we can help because we don't know what the target is doing with the information. – schroeder Mar 6 '17 at 17:40
  • It is only a bug bounty program for a certain company that i test and it isn't username credential by the mean of a login form . – Mohamed Osama Mar 6 '17 at 18:00
0

The Error Code 400 means that the request was malformed. This means the request sent by the client(you, using burpsuite) to the server didn't fit the 'rules' of http.

In the case of a REST API with a JSON payload, 400's are typically used to indicate that the JSON is invalid in some way according to the API specification for the service. Which you didn't supply in your question. Maybe if you give some more information, i can answer more detailed. Meanwhile i suppose that the 400 is correct behavior indicating that this request is malformed in some unspecific way. I think 400 is the intended response for a nonexistent email in this JSON-request.

  • 1
    Thx you are right .The 400 error code is only for nonexistent email in the JSON Request – Mohamed Osama Mar 6 '17 at 21:19
  • @MohamedOsama good to hear that it helped! can you accept my answer? greetings – Gewure Mar 6 '17 at 21:56
  • 1
    Done thx you again ! – Mohamed Osama Mar 6 '17 at 23:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.