> For the complete documentation index, see [llms.txt](https://repo.4pfsec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://repo.4pfsec.com/portswigger-labs/authentication/username-enumeration-via-different-responses.md).

# Username enumeration via different responses

This lab is vulnerable to username enumeration and password brute-force attacks.

The target site has an account with a predictable username and password, which can be found in the following wordlists:

{% file src="/files/i6sHt53O6AovpOQzHtgA" %}

{% file src="/files/XFcrGLauFqq1PWEPhOGc" %}

To solve the lab, enumerate a valid username, brute-force this user's password, then access their account page.

## Enumeration

`Home Page`

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fn00wSNAaHNh0UGXfiynz%2Fimage.png?alt=media\&token=f43eb46e-4338-4c5a-87d8-14be6f711e15)

`Login Page`

![Login Form](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FEGXPQe0kCFReMuZaQuXg%2Fimage.png?alt=media\&token=0a87ece6-00fe-4167-b1bf-e6461aecfa3d)

![Login Form](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FJdD8v4wLeEVebpJqMbhl%2Fimage.png?alt=media\&token=36eb887b-7d77-457c-a965-7bf31220c098)

![Error Message](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fji39GS6ZcsHZZZDRWyQm%2Fimage.png?alt=media\&token=5e201253-3071-4cd6-9254-102be18d84e1)

Upon Inspection of the login page, we are able to get a detailed response regarding the entered information.

## Exploitation

### Username Enumeration

Setup burp to intercept requests.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FxMPh5tZt0mujiZbtaksd%2Fimage.png?alt=media\&token=9b8b0414-eb15-4700-a867-98a9bdc943fc)

Make a login request with random credentials and intercept it with burp.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FE6vI9VY0XrxWQ7bIs0oq%2Fimage.png?alt=media\&token=02a06ed0-0ae1-4904-a4b6-333899b07d03)

In the response of that request, we are able to see that the site returns `Invalid Username`

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F08i2vctMgiooTOy8JfcW%2Fimage.png?alt=media\&token=2d91bafb-b33f-482f-94dd-aee400f28771)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FyYOAMEZKiEsyRK1BCpf5%2Fimage.png?alt=media\&token=922f55c5-4e95-4756-a156-50e53b5a99c4)

Right-click on the `POST` request and send it to the intruder tab

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fpd7EPesolRxLWtkTzeVd%2Fimage.png?alt=media\&token=5fd08d13-49d5-41f2-a640-d2beace1cc18)

Head over to the Intruder tab and clear all markings

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FCUT16NtVePB8Vadq3OW2%2Fimage.png?alt=media\&token=47bcb8f3-77d4-4b09-bf00-151b22b07144)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FB7ipjITuScKreSG5u4JU%2Fimage.png?alt=media\&token=1a721ab2-b7c7-4851-a9f1-bee5756aa79e)

Mark only the username field

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FWJegFoOebuAd7WTN0UVJ%2Fimage.png?alt=media\&token=3a4ce80a-2d3f-4c34-9c61-8261414eed48)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fp8WiYnv33Zl4eNRvxHeE%2Fimage.png?alt=media\&token=866c3ecf-4ae4-40f3-8d02-3e5ece73bee5)

Head over to the payloads tab under Intruder and make sure the following options are set and paste the username list for enumeration.

```jsx
Payload set: 1
Payload type: Simple List
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F4e8LnDyHiA9DuRok426p%2Fimage.png?alt=media\&token=d2ff2670-c8e6-4190-b459-bfedb815b1e6)

Once done, hit start attack. (ignore error, if any)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FMawumcptPi0m1wAwwISq%2Fimage.png?alt=media\&token=1168047c-aace-48ce-b3ee-5ae72dce1090)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F7YMNyeTtgyU0KvFSyazN%2Fimage.png?alt=media\&token=fc0e2d28-817d-45a1-bd7f-07a2db2d6fd3)

Once, attack is completed, sort the requests according to Length. When done so, one of the requests should have a longer length compared to the rest as shown below.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FyrsqxHUrdECg0UyFUIsD%2Fimage.png?alt=media\&token=12fe46da-3f89-434b-84d0-0a1ced08b59f)

Upon further inspection of that request, we are able to see a new error as such. This confirms that the username is indeed `application`

```jsx
Incorrect password
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F1DqYdvbyOkRpWUQ3Eq1e%2Fimage.png?alt=media\&token=1620d865-3379-4049-b51f-3aa31c68516b)

### Password Enumeration

Now repeat the process all over again but target the password field with the password list while keeping the username a constant.

Right-click on the `POST` request and send it to the intruder tab

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FNBPl0qloep6aDBTkCDkw%2Fimage.png?alt=media\&token=b3acf972-2e9a-4c2c-9a9a-73d04194c4ac)

Setup the positions as such

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FDd0ZxjOFjgwBWzo3oT9b%2Fimage.png?alt=media\&token=fbc91f65-c51a-4449-9790-a6c78637bcd9)

Paste the password list where the username list was

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fqcaj8ynmDuc8iS3YrpBk%2Fimage.png?alt=media\&token=679174d3-9114-43d0-b764-572321ef64bf)

Start the attack

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FVilTmeahennLhizeplom%2Fimage.png?alt=media\&token=7bfca645-45ba-4999-b2a2-aa5710b4bd9a)

Once, attack is completed, sort the requests according to Length. When done so, one of the requests should have a longer length compared to the rest as shown below. The 302 status code indicates a redirect and looking at the `location` parameter in the response confirms that we have indeed got the right password. (`soccer`)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F2LZdEh4zY0AKV5X7iJDj%2Fimage.png?alt=media\&token=f5050fe7-5850-4c8f-b26b-479fc1cf21c2)

Upon Logging in with the found credentials, we complete the lab.

```jsx
application:soccer
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FRFfWDoL4ZvoUYFKCsbtY%2Fimage.png?alt=media\&token=25112006-36a9-46b7-9ef6-a0d1a01338bb)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F98oyQ7btZcYPIbkYPMUe%2Fimage.png?alt=media\&token=cadd3258-221d-4f68-93ea-4efd9c66a0f9)

✅