1. Web Security Academy
  2. Authentication
  3. Password-based
  4. Lab

Lab: Username enumeration via subtly different responses


This lab is subtly vulnerable to username enumeration and password brute-force attacks. It has an account with a predictable username and password, which can be found in the following wordlists:

To solve the lab, enumerate a valid username, brute-force this user's password, then access their "My account" page.