Authorization disclaimer. This walkthrough is limited to the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Test only systems you own or are explicitly authorized to assess.

Overview

Repeated login attempts produce an observable difference for valid and invalid usernames, allowing the lab account to be identified before password testing.

The Academy brief identifies a login form with candidate username and password lists and requires access to the discovered user's account page.
The Academy brief identifies a login form with candidate username and password lists and requires access to the discovered user's account page.

Lab objective/setup

The supplied credentials, candidate lists, email client, and exploit server are used only inside this Academy instance to reproduce the authentication-flow evidence shown below.

What I observed

The login endpoint returns Invalid username for nonexistent accounts and Incorrect password when the username exists. Intruder first isolates info by that response change, then finds 654321 through the sole redirecting password response.

The login page displays the explicit failure message “Invalid username,” revealing that this request failed before password validation.
The login page displays the explicit failure message “Invalid username,” revealing that this request failed before password validation.

Why it is vulnerable

Authentication failures disclose account existence through response text, lockout behavior, or another stable response characteristic.

Walkthrough in the authorized PortSwigger lab

Enumerate the username list against POST /login, select the response that changes to Incorrect password, and repeat the attack against that account with the password list. The 302 Found result authenticates as info and opens the account page.

Burp Intruder username results contain one response with a different length; its body says “Incorrect password,” identifying `info` as an existing account.
Burp Intruder username results contain one response with a different length; its body says “Incorrect password,” identifying `info` as an existing account.
The password attack for `info` contains one `302 Found` response while ordinary guesses return `200`, identifying `654321` as the accepted password.
The password attack for `info` contains one `302 Found` response while ordinary guesses return `200`, identifying `654321` as the accepted password.

Verification

The final capture shows the Academy marking the username enumeration via different responses exercise as solved after the documented request sequence. No testing was performed outside the isolated lab.

The browser shows the solved banner above the My Account page for username `info`, confirming successful authentication.
The browser shows the solved banner above the My Account page for username `info`, confirming successful authentication.

Impact and defensive lesson

Authentication controls must bind identity, challenge state, reset tokens, and retry counters to server-side transactions. Return uniform failures, rate-limit by both account and trusted client signals, and use random revocable persistent-session tokens rather than credential-derived values.

References