https://portswigger.net/web-security/learning-paths/server-side-vulnerabilities-apprentice/authentication-apprentice/authentication/password-based/lab-username-enumeration-via-different-responses
Last updated
This lab is vulnerable to username enumeration and password brute-force attacks. It has an account with a predictable username and password, which can be found in the following wordlists:
To solve the lab, enumerate a valid username, brute-force this user's password, then access their account page.
We've a usernames and passwords lists, the idea is first to enumerate users and after take a password brute-force.
Go to login, insert random data and capture the request:
Send the request to Burp Intruder and select as parameter the username value "admin", copy and paste userlist to Payload section and start attack:
Ordering length value, we can see that only one has a different value, and there's not the error message: "Invalid username" but "Incorrect password"
so we know that "argentina" user is a valid username.
Now, is possible to proceed with password brute-force, go back to intruder, click on clear, modify the username value inserting 'argentina' and select password field adding passwordlist values
Ordering the different length values we can quicky discover the argentina's password:
Now we can go to login page and access using the following credentials: argentina::computer solving the lab.
