Portswigger
  • Portswigger
  • Server-Side Request Forgery
    • Server-Side Request Forgery (SSRF)
  • SSRF with filter bypass via open redirection vulnerability
  • Blind SSRF with out-of-band detection
  • Cross-Site Scripting
    • Cross-Site Scripting (XSS)
  • Reflected XSS into a JS string with angle brackets and double&single quotes HTML-encoded escape
  • XSS into a template literal w/ angle brackets, single, double quotes, backslash & backticks Escaped
  • Authentication
    • Authentication
  • Username enumeration via subtly different responses
  • 2FA broken logic
  • Username enumeration via response timing
  • Username enumeration via account lock
  • Password reset poisoning via middleware
  • Path Traversal
    • Path Traversal
  • File path traversal, traversal sequences stripped with superfluous URL-decode
  • File path traversal, traversal sequences blocked with absolute path bypass
  • Business Logic Vulnerabilities
    • Business Logic Vulnerabilities
  • Insufficient workflow validation
  • Inconsistent handling of exceptional input
  • Server-Side Template Injection
    • Server-Side Template Injection
  • Basic server-side template injection
  • Basic server-side template injection (code context)
  • SQL Injection
    • SQL Injection
    • Blind SQL injection with conditional responses
  • SQL injection UNION attack, retrieving data from other tables
  • SQL injection attack, listing the database contents on non-Oracle databases
  • API Testing
    • API Testing
  • Exploiting an API endpoint using documentation
  • Exploiting a mass assignment vulnerability
  • Finding and exploiting an unused API endpoint
  • JWT ATTACK
    • JWT Attack
    • JWT authentication bypass via unverified signature
  • JWT authentication bypass via jku header injection
  • JWT authentication bypass via flawed signature verification
  • HTTP HOST HEADER ATTACKS
    • HTTP Host header attacks
  • Basic password reset poisoning
  • Host header authentication bypass
  • No SQL Injection
    • NoSQL Injection
  • Detecting NoSQL injection
  • Exploiting NoSQL operator injection to bypass authentication
  • Exploiting NoSQL injection to extract data
  • FILE UPLOAD VULNERABILITIES
    • File Upload Vulnerabilities
  • Web shell upload via obfuscated file extension
  • OAuth Authentication
    • OAuth Authentication
  • OAuth account hijacking via redirect_uri
  • ACCESS CONTROL VULNERABILITIES
    • Access Control Vulnerabilities
  • User ID controlled by request parameter with data leakage in redirect
  • User ID controlled by request parameter with password disclosure
  • User role controlled by request parameter
  • User role can be modified in user profile
  • URL-based access control can be circumvented
  • INFORMATION DISCLOSURE VULNERABILITIES
    • Information Disclosure Vulnerabilities
  • Information disclosure in version control history
  • XML external entity injection
    • XML External Entity (XXE) Injection
  • Exploiting XXE using external entities to retrieve files
  • Exploiting blind XXE to retrieve data via error messages
  • Blind XXE with out-of-band interaction
  • Blind XXE with out-of-band interaction via XML parameter entities
  • OS COMMAND INJECTION
    • OS Command Injection
  • Blind OS command injection with out-of-band data exfiltration
  • PROTOTYPE POLLUTION
    • Prototype Pollution
  • Privilege escalation via server-side prototype pollution
  • WEB CACHE POISONING
    • Web Cache Poisoning
  • Web cache poisoning via an unkeyed query parameter
Powered by GitBook
On this page

Username enumeration via account lock

Link: https://portswigger.net/web-security/authentication/password-based/lab-username-enumeration-via-account-lock

PreviousUsername enumeration via response timingNextPassword reset poisoning via middleware

Last updated 3 months ago

Description:

This lab is vulnerable to username enumeration. It uses account locking, but this contains a logic flaw. To solve the lab, enumerate a valid username, brute-force this user's password, then access their account page.

Proof of concept:

  1. Lakukan analisa pada web target

  2. Lakukan request login pada web target dengan menjalankan proxy burp suite

  3. Setelah mengaktifkan proxy burp suite, lalu lintas request & response dapat terlihat. Kirim request endpoint login ke burp suite intruder

  4. Atur payload untuk parameter username dan password menggunakan payload yang telah disediakan, gunakan type attack Cluster bomb attack

  5. Jika sudah, jalankan serangan. Lihat response yang diberikan. Terlihat terdapat payload dengan length response yang berbeda. Length berbeda tersebut dikarenakan response yang diberikan berbeda yaitu You have made too many incorrect login attempts. Please try again in 1 minute(s). bukan lagi Invalid username or password. . Artinya kemungkinan, request yang berisi payload dengan payload username tersebut merupakan username yang valid. Ambil username tersebut dan hentikan serangan agar mempercepat proses eksploitasi

  6. Buat kembali request login untuk di burp suite intruder dengan nilai username adalah username yang sebelumnya telah didapati pada proses guessing credentials sebelumnya. Lalu atur payload untuk parameter password dengan payload password yang telah disediakan. Gunakan type attack Snipper attack dikarenakan hanya akan melakukan brute force pada satu data yaitu data password saja

  7. Jika sudah jalankan serangan, dan terlihat terdapat length request yang berbeda dari yang lainnnya, dimana pada request tersebut tidak menampilkan pesan kesalahan apapun. Maka dapat diasumsikan, bahwa payload password tersebut merupakan kombinasi yang tepat dari username yang sebelumnya telah didapatkan

  8. Untuk memastikannya, login menggunakan username dan password yang sebelumnya telah didapati. Dan terlihat berhasil login menggunakan kombinasi credential tersebut dan tantangan pada lab ini pun berhasil terselesaikan

Thanks, Stay Ethical & Happy Hacking! 🍻

Candidate usernames
Candidate passwords