Authorization disclaimer. This walkthrough is limited to the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Test only systems you own or are explicitly authorized to assess.

Overview

Login responses take measurably different time depending on whether the supplied username reaches password verification, enabling account discovery.

The Academy brief supplies `wiener:peter`, username and password lists, and requires account access using a response-time side channel.
The Academy brief supplies `wiener:peter`, username and password lists, and requires account access using a response-time side channel.

Lab objective/setup

The supplied credentials, candidate lists, email client, and exploit server are used only inside this Academy instance to reproduce the authentication-flow evidence shown below.

What I observed

The application performs slower password work for an existing username. Rotating X-Forwarded-For avoids the one-minute IP block, while a long password amplifies the delay and identifies academico; a second attack finds love.

The Intruder request places payload markers in `X-Forwarded-For` and `username` and sends a deliberately long password to amplify password-check time.
The Intruder request places payload markers in `X-Forwarded-For` and `username` and sends a deliberately long password to amplify password-check time.
The numeric payload configuration rotates `X-Forwarded-For` values from 1 through 100 so repeated login probes are not grouped under one client address.
The numeric payload configuration rotates `X-Forwarded-For` values from 1 through 100 so repeated login probes are not grouped under one client address.

Why it is vulnerable

Even with uniform messages, conditional expensive work creates a timing side channel that distinguishes valid accounts.

Walkthrough in the authorized PortSwigger lab

Use Pitchfork positions for a rotating X-Forwarded-For value and the username list, keep a long fixed password, and compare response time. Then hold academico constant, rotate the header again, and identify the password response that redirects.

The Pitchfork username results show `academico` with the largest response time, distinguishing it from the faster nonexistent-user responses.
The Pitchfork username results show `academico` with the largest response time, distinguishing it from the faster nonexistent-user responses.
The password results for `academico` contain a unique response length and a `302 Found` redirect for payload `love`, unlike rejected guesses.
The password results for `academico` contain a unique response length and a `302 Found` redirect for payload `love`, unlike rejected guesses.

Verification

The final capture shows the Academy marking the username enumeration via response timing exercise as solved after the documented request sequence. No testing was performed outside the isolated lab.

The solved banner appears above the My Account page for `academico`, confirming the timing discovery and accepted password.
The solved banner appears above the My Account page for `academico`, confirming the timing discovery and accepted password.

Impact and defensive lesson

Authentication controls must bind identity, challenge state, reset tokens, and retry counters to server-side transactions. Return uniform failures, rate-limit by both account and trusted client signals, and use random revocable persistent-session tokens rather than credential-derived values.

References