Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Issues with Burp scan and authentication

Johnson, | Last updated: Feb 27, 2019 08:05PM UTC

I've read through many posts here and have not come accross anyone having the same issue as I have. From the Server where Burp is installled, I can browse to the web page I need to scan and look at all options with any current browser (FF, Chrome, IE). When I setup browsers to proxy through Burp and test, I get an authentication pop-up going to this same site. The auth never works with a valid account I've tried Platform Authentication with no luck. I found out that the website is behind a Netscaler interface, so I tried setting up the Upstream Proxy settings, but no luck there either. Same pop-up and error. I've looked at everything including importing certificates, etc. In the alerts section, I see some interesting logs during my connection attempts: <number> proxy [6] Authentication failure from <mywebsite.domain.com> <number> proxy [6] Unknown host: ubzefwfvm <number> proxy [6] Unknown host: rfyexesp <number> proxy [6] Unknown host: yltzdfteydafth

PortSwigger Agent | Last updated: Mar 01, 2019 04:16PM UTC

It sounds like the application is using NTLM authentication. When you use a browser, your Windows credentials are automatically used. Platform Authentication should be the solution to this. You may need to fiddle with the settings a bit more. The destination host is the domain you're authenticating to. Authentication type NTLMv2, The domain is the Windows domain that your user exists within. It sounds like this is not an Upstream Proxy issue.

Burp User | Last updated: Mar 05, 2019 09:10PM UTC

Yes, I've been working through this and know I'll need to use the platform authentication. I've tried each Auth type with no luck.

PortSwigger Agent | Last updated: Mar 06, 2019 08:11AM UTC

To help us diagnose this, please screenshot your configuration and also a relevant decode using NTLM Challenge Decoder (in the BApp Store) and send to support@portswigger.net

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.