Portswigger lab: Authetication Vulnerabilities - Username enumeration via subtly different response

This article provides a step-by-step walkthrough of the second lab from PortSwigger's Authentication Vulnerabilities section.

Start the lab by clicking the "Access the lab" button. Once the lab environment loads, click the "My Account" option. This will take you to the login page, where the authentication process begins.Before attempting to log in, make sure Burp Suite Intercept is turned ON. Enter any random username and password and attempt to log in.The authentication attempt will fail, which is expected because the objective of this lab is to identify valid credentials by exploiting the authentication vulnerability.

Burp Suite will capture the HTTP login request. In the intercepted request, you can see the submitted username and password parameters. Right-click on the request and select Send to Intruder to begin the attack.

In Burp Suite Intruder, highlight the username value and set it as the payload position. Under the Payloads tab, keep the Payload type set to Simple list. Then, copy and paste the Candidate Usernames list provided in the lab description into the payload configuration.

Now, click on the Intruder settings side panel. Scroll down to the Grep — Extract section and click Add.A new dialog box will appear. Click Fetch response to load a sample server response. Scroll down until you find the text "Invalid username or password", highlight it, and click OK.

Once everything is configured, click Start attack to begin testing the usernames.

As the attack runs, carefully observe the Warnings column. Most responses will contain the message "Invalid username or password.". However, one request will display "Invalid username or password" instead. This difference indicates that the username is valid, but the password is incorrect. The username associated with that request is the correct username.

Return to Burp Suite Intruder and update the request by replacing the username with the valid username you identified in the previous step. Next, highlight the password value and set it as the payload position. Under the Payloads tab, keep the Payload type set to Simple list, clear the previous payload list, and then copy and paste the Candidate Passwords list provided in the lab description into the payload configuration. Leave the Grep — Extract settings unchanged, as they are still needed for this attack. Once everything is configured, click Start attack to begin testing the passwords.

In the attack results, observe the Status column. Most requests will return a 200 OK status code, indicating that the login attempt failed and the login page was reloaded. However, one request will return a 302 Found status code. This redirect indicates a successful login, meaning the corresponding payload is the correct password.

Congratulations! You have successfully identified the valid credentials:

Username: puppet
Password: michael