Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Close http request if time takes more than limit.

Pawan | Last updated: Jan 24, 2019 02:33PM UTC

I'm using intruder attack to check if otp is valid and then use that otp for different transaction. but one otp is allowed for single transaction. if otp is validated then i get response 'otp already consumed' else i get response 'invalid otp'. i want to know which otp is valid before validating. how to do that..

Liam, PortSwigger Agent | Last updated: Jan 24, 2019 04:16PM UTC

By design the OPT is only able to make one transaction. Burp can't confirm the validity of a password without performing this transaction. You'd have to perform whatever testing you require in the same request as the validity test.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.