1. Web Security Academy
  2. Authentication
  3. Password-based
  4. Lab

Lab: Username enumeration via account lock

PRACTITIONER

This lab is vulnerable to username enumeration. It uses account locking, but this contains a logic flaw. To solve the lab, enumerate a valid username, brute-force this user's password, then access their "My account" page.