ticarpi
Burp's Error but 200 OK
Hey,
while doing some tests I always got "get one Response Code: 200, 1370 bytes" in the same check. When I checked manually, I saw that there was no such weakness. When I ran jwt_tool again, it said that it had positive results in the same place but there is no answer for this step on the proxy (burp) side.
After doing some debugging, that the response to jwt_tool was not from the website but from the burp side.
jwttool_f41925380723b445729eb6954776ed4b Checking for alternative accepted HMAC signatures, based on common passwords. Testing: Secret key. You can use `mix guardian.gen.secret` to get one Response Code: 200, 1370 bytes-b'<html><head><title>Burp Suite Professional</title>\r\n<style type="text/css">\r\nbody { background: #dedede; font-family: Arial, sans-serif; color: #404042; -webkit-font-smoothing: antialiased; }\r\n#container { padding: 0 15px; margin: 10px auto; background-color: #ffffff; }\r\na { word-wrap: break-word; }\r\na:link, a:visited { color: #e06228; text-decoration: none; }\r\na:hover, a:active { color: #404042; text-decoration: underline; }\r\nh1 { font-size: 1.6em; line-height: 1.2em; font-weight: normal; color: #404042; }\r\nh2 { font-size: 1.3em; line-height: 1.2em; padding: 0; margin: 0.8em 0 0.3em 0; font-weight: normal; color: #404042;}\r\n.title, .navbar { color: #ffffff; background: #e06228; padding: 10px 15px; margin: 0 -15px 10px -15px; overflow: hidden; }\r\n.title h1 { color: #ffffff; padding: 0; margin: 0; font-size: 1.8em; }\r\ndiv.navbar {position: absolute; top: 18px; right: 25px;}\r\ndiv.navbar ul {list-style-type: none; margin: 0; padding: 0;}\r\ndiv.navbar li {display: inline; margin-left: 20px;}\r\ndiv.navbar a {color: white; padding: 10px}\r\ndiv.navbar a:hover, div.navbar a:active {text-decoration: none; background: #404042;}\r\n</style>\r\n</head>\r\n<body>\r\n<div id="container">\r\n<div class="title"><h1>Burp Suite Professional</h1></div>\r\n<h1>Error</h1><p>No response received from remote server.</p>\r\n<p> </p>\r\n</div>\r\n</body>\r\n</html>\r\n'
]
Shame that Burp uses a 200 response for error page. Trying to identify the cause here. Can you provide the command you used to run this? In particular where the JWT was being used in the request.
