Web Security Lab — Username Enumeration via Different Responses | PortSwigger

The Lab

A login page vulnerable to username enumeration and brute-force. Two wordlists provided — 101 usernames, 100 passwords. Objective: find valid credentials and log in. Tool needed: Burp Suite Intruder.

What is Username Enumeration?

When a login form returns different responses for "wrong username" vs "wrong password" — even slightly different — an attacker can use that difference to confirm which usernames actually exist before touching the password field. That information leak is the entire vulnerability.

Step 1 — Intercept and Send to Intruder

I submitted admin/admin on the login page with Burp intercepting. The server said "Invalid username."

I sent the request to Intruder, marked the username field as the payload position, loaded the 101 username wordlist, and ran a Sniper attack.

Step 2 — Spot the Username

101 requests. Every response came back with status 200 and length 3352.

Except request 21 — username access — length 3354. Two bytes longer.

I rendered that response. Instead of "Invalid username" it said "Incorrect password."

Username confirmed: access

Step 3 — Brute-Force the Password

I updated the payload position to the password field, kept access as the fixed username, loaded the 100 password wordlist, and ran the attack again.

This time I watched the Status code column.

Every request: 200. Except request 96 — password monitor — returned 302.

302 = redirect = successful login.

Credentials confirmed: access / monitor

What I Actually Learned

Tiny differences leak enormous information. Two bytes of length difference across 101 responses. One different status code across 100. These are real signals in real penetration testing — not just lab tricks.

Error messages are a security decision. Both "invalid username" and "incorrect password" should return identical generic messages in production. This lab made that principle concrete.

Status codes matter. 200 = page loaded normally. 302 = redirect = something worked. Reading these instinctively is a fundamental web security skill.

Tools Used

Burp Suite Community Edition — proxy, Intruder (Sniper mode), response analysis

GitHub: github.com/CipherCoded-Dev