Username enumeration via different responses |portSwigger

eeeee………..Today we will solve All labs of Authentication ………..

First , we will open portSwigger.com Then choose View All Labs (Authentication).

OPEN THE LAB ..

Lab tell u to enumerate username and brute-force to get password .

And u will use username && passwords WordList to solve it let's see how to solve that step by step ; click "— ACCESS THE LAB —'' .

Let's write username=admin && password = admin to see what error happen .. click log in .

what that mean , just username is not correct , just go and open burpsuite to see what happend on the background ,…

here normal post Request , let's try to enumerate the username , Just send the Request to Intruder then add ,,

Then In Section Payloads

let's Paste wordlist which Lab suggest for username enumerate .

Just trick for u , if username valid Response will be different

"Incorrct password " u will get → how u will catch that From

Length

click on it let's see if that true or not .

1. Username : applications
2. password : ???????????

now we will do the same for password

u can use hydra or any recon tool , i prefer burpsuite

we solved the lab

Username : applications

Password :qazwsx

→ → → → → → → →

i hope u got it , see u in next labs ……bye;