Daemon Of Hacking
  • WELCOME!
    • 👋/home/usr/KruKnight
  • METHODOLOGIES & RESOURCES
    • Passwords & Attacks
    • Post Exploitation
      • 👀Situational Awareness
      • 🖥️Privilege Escalation
        • Linux Privilege Escalation
        • Windows Privilege Escalation
  • Writeups
    • CyCtf 2024
      • Vending Machine
      • Aerospace
      • OhMyCell
    • Portswigger Labs
      • Authentication
        • Username enumeration via different responses
        • 2FA simple bypass
        • Password reset broken logic
        • Username enumeration via subtly different responses
        • Username enumeration via response timing
        • Broken Brute-Force Protection, IP Block
        • Username enumeration via account lock
        • 2FA broken logic
        • Brute-forcing a stay-logged-in cookie
        • Offline password cracking
        • Password reset poisoning via middleware
        • Password brute-force via password change
        • Broken brute-force protection, multiple credentials per request
      • Os Command Injection
        • OS command injection, simple case
        • Blind OS command injection with time delays
        • Blind OS command injection with output redirection
        • Blind OS command injection with out-of-band interaction
        • Blind OS command injection with out-of-band data exfiltration
      • Cross-Origin Resource Sharing (CORS)
        • CORS vulnerability with basic origin reflection
        • CORS vulnerability with trusted null origin
        • CORS vulnerability with trusted insecure protocols
      • Server-side template injection
        • Basic server-side template injection
        • Basic server-side template injection (code context)
      • Server-Side Request Forgery (SSRF)
        • Basic SSRF against the local server
        • Basic SSRF against another back-end
        • Blind SSRF with out-of-band detection
        • SSRF with blacklist-based input filter
        • SSRF with filter bypass via open redirection vulnerability
      • Path Traversal
  • 🟩HTB Writeups
    • Heal
Powered by GitBook
On this page
  • Lab description
  • Solution
  • Step 1: Capturing the Login Request
  • Step 2: Enumerating the Username
  • Step 3: Identifying the Valid Username
  • Step 4: Brute-Forcing the Password
  • Step 5: Identifying the Correct Password

Was this helpful?

  1. Writeups
  2. Portswigger Labs
  3. Authentication

Username enumeration via different responses

PreviousAuthenticationNext2FA simple bypass

Last updated 6 months ago

Was this helpful?

Lab description

Solution

Step 1: Capturing the Login Request

The first step is to capture the login request using an interception with Burp Suite. As shown in the request, there are two parameters: username and password.

Step 2: Enumerating the Username

  • Send the Intercepted Request to Intruder: In Burp Suite, send the captured request to Intruder. Clear all the selected positions and mark only the username field as a payload position.

  • Configure Payloads: In the Payloads tab, paste the provided list of usernames.

  • Start the Attack: Initiate the attack to test each username.

Step 3: Identifying the Valid Username

  • Analyze the Responses: After the attack is completed, look at the response lengths.

    • One of the usernames will have a different response length compared to the others.

    • Upon reviewing the rendered page, this username will also display a different error message, confirming it as valid.

Upon getting the correct Username, we proceed to brute force the passwords as follows

Step 4: Brute-Forcing the Password

  • Set Up the Password Attack: Repeat the same process, but this time mark the password field as the payload position. Use the provided password list as payloads.

  • Start the Attack: Launch the attack to test each password.

Step 5: Identifying the Correct Password

  • Analyze the Responses: Once the attack is complete, look for a response with:

    • A different length from the others.

    • A status code 302 or a success message in the response, indicating a successful login.

  • Result:

    • The username and password pair is now verified, and you can use them to access the account.