[lilium51]

So i have succesfully guessed credentials for an admin page of some site, however when i try to login it redirects me back in a sec.
What could be the reason? Was i detected? What should i try in this situation?

[T3h Hack3r]

Hi there. It sounds like the credentials are locked to a certain IP address, if you have an intercept tool handy like Zap Proxy or Burpsuite you may be able to change your originating IP address to something like 127.0.0.1 or localhost via the X-Forwarded-For header, this has worked for me within the past for actual penetration tests I have done for clients. You can read more about this attack here.

[lilium51]

Hi there. It sounds like the credentials are locked to a certain IP address, if you have an intercept tool handy like Zap Proxy or Burpsuite you may be able to change your originating IP address to something like 127.0.0.1 or localhost via the X-Forwarded-For header, this has worked for me within the past for actual penetration tests I have done for clients. You can read more about this attack here.

Thank you, it is interesting technique. I tried it in Burp, but got redirected again.
So, login.php redirects to index.php after entering credentials, and index.php back to login.php via window.location.
That's everything i learned from Burp.