# Username enumeration via subtly different responses

## Lab Description

<figure><img src="https://2387347627-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F47EuhANOY5sIuDySBX97%2Fuploads%2FOcqYhUXbO4Rti4EzJTcW%2Fimage.png?alt=media&#x26;token=cdc1a172-1bff-4e0f-b3d0-f02bc4a25686" alt=""><figcaption></figcaption></figure>

## Walkthrough

### **Step 1: Observing the Login Page**

On the login page, we see a generic error message: `Invalid username or password.` Our task is to determine if there's any subtle difference in the server's response for valid usernames.

<figure><img src="https://2387347627-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F47EuhANOY5sIuDySBX97%2Fuploads%2FBTAumgpbFaXWzzY4Fggt%2Fimage.png?alt=media&#x26;token=8cc61d30-69bf-4869-9258-3469f8ae7ab6" alt=""><figcaption></figcaption></figure>

### **Step 2: Capturing the Login Request**

Using **Burp Suite**, intercept the login request when attempting to log in with arbitrary credentials (e.g., `test:test`).

The captured request contains two key parameters:

* **Username**: The input username.
* **Password**: The input password.

Send this intercepted request to **Intruder** for automated testing.

### **Step 3: Enumerating Usernames**

**Configuring Intruder for Username Testing**

1. **Set Payload Positions**:
   * Clear all selected payload positions and mark only the `username` parameter.
2. **Payloads**:
   * Go to the Payloads tab and paste the provided username list.
3. **Start the Attack**:
   * Launch the attack to send the modified requests.

<figure><img src="https://2387347627-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F47EuhANOY5sIuDySBX97%2Fuploads%2FZkmgItnCsSIMvIJkJ6RU%2Fimage.png?alt=media&#x26;token=e5725fa8-a73a-4189-bc6e-26918ab7960e" alt=""><figcaption></figcaption></figure>

#### **Analyzing Responses**

Once the attack finishes, filter the results to search for any differences in responses:

* Use **Burp's search feature** with the error message text `Invalid username or password.` and enable **negative search**.
* Identify responses that deviate slightly from the standard error message.

<figure><img src="https://2387347627-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F47EuhANOY5sIuDySBX97%2Fuploads%2FaxAIUGAk6zMxuKFJK6v1%2Fimage.png?alt=media&#x26;token=29915606-cc63-4a1d-96ba-8cdeb5178fc3" alt=""><figcaption></figcaption></figure>

Upon doing that, we can see that there's one username with a slightly different error message, `invalid username or password.`   vs `invalid username or password`notice the mission dot &#x20;

guessing with a different response that this username is a valid one

<figure><img src="https://2387347627-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F47EuhANOY5sIuDySBX97%2Fuploads%2FJ4yiRXttHOYptY9j54AV%2Fimage.png?alt=media&#x26;token=7a0625d6-f307-4918-9b9d-f467a0d4357f" alt=""><figcaption></figcaption></figure>

### **Step 4: Brute-Forcing the Password**

**Configuring Intruder for Password Testing**

1. **Set Payload Positions**:
   * Modify the `username` parameter to the valid username (`app01`) identified earlier.
   * Mark the `password` parameter as the payload position.
2. **Payloads**:
   * Use the provided password list as the payload.
3. **Start the Attack**:
   * Launch the attack to test passwords for the identified username

<figure><img src="https://2387347627-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F47EuhANOY5sIuDySBX97%2Fuploads%2FTaqcUF5PiRMVUDciW4Xu%2Fimage.png?alt=media&#x26;token=928951e7-8887-442f-92fe-19a6378ca9f8" alt=""><figcaption></figcaption></figure>

#### **Analyzing Responses**

After sorting the results by **status codes**, we find a request that returns a `302 Found` response. This indicates that the correct password has been identified.

<figure><img src="https://2387347627-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F47EuhANOY5sIuDySBX97%2Fuploads%2Fuzn5gNKA9s6C8RV692jA%2Fimage.png?alt=media&#x26;token=884b5728-2229-4d7f-8a9e-b3711dd9b2bd" alt=""><figcaption></figcaption></figure>

### **Step 5: Verifying Access**

Using the discovered credentials (`app01:qazwsx`), we log into the account successfully and access the user’s account page.

<figure><img src="https://2387347627-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F47EuhANOY5sIuDySBX97%2Fuploads%2F1MLTeLD3Uv9V5QHCKU60%2Fimage.png?alt=media&#x26;token=d280ef52-63e7-4f36-9f87-64239565006a" alt=""><figcaption></figcaption></figure>
