---
description: >-
  https://portswigger.net/web-security/authentication/password-based/lab-username-enumeration-via-subtly-different-responses
---

# Username enumeration via subtly different responses

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FRgsdCRY2SXjTJPiRvWcg%2F1.png?alt=media&#x26;token=3fbccf82-cc0e-489d-9421-7791fd508f91" alt=""><figcaption></figcaption></figure>

Let's click on the `My account` button.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F29ZsDmZl8npKcJX7hgdq%2F2.png?alt=media&#x26;token=6df825b6-dcf9-4d36-89b6-7d3be072d969" alt=""><figcaption></figcaption></figure>

We are proxying the traffic through Burp Suite. Therefore we can find the login request in the `Proxy > HTTP History` tab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FFtACUPiQZ8r2BSQgh4pA%2F3.png?alt=media&#x26;token=0e43735f-480e-46c5-b7aa-82c06fb3bc82" alt=""><figcaption></figcaption></figure>

Let's forward the request to the `Intruder`. Once in the `Intruder`, let's set the payload field on the `username` parameter.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FT0nzE3HaVnccYItnxfHw%2F4.png?alt=media&#x26;token=1998765c-9b6b-4281-8383-d9ccee099970" alt=""><figcaption></figcaption></figure>

Now we have to set the payload type to `Simple list`. Once that is done, we can paste the usernames provided to us here in the `Payloads settings` section.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FErkqcEtYOHSRMMuG0rnt%2F5.png?alt=media&#x26;token=a93aca03-c2de-4e4f-b42d-17520461e1ec" alt=""><figcaption></figcaption></figure>

Next, in the `Intruder > Settings` tab, we have to go to the `Grep - Extract` section and clink on the `Add` button.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FRAPGKlorxVul4MpBd0fK%2F6.png?alt=media&#x26;token=6b7f1e5f-a678-40fb-80d4-bb887efca9e6" alt=""><figcaption></figcaption></figure>

Inside the pop-up, select the following string from the response:

```
Invalid username or password.
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FsJw9EjayLI7jjlJ4DtwN%2F7.png?alt=media&#x26;token=e82a44c2-5103-4dfa-9b94-0e09689a4cc0" alt=""><figcaption></figcaption></figure>

We can now start the attack.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2Ffn7o9ZLgvRJ6vN0oEgF9%2F8.png?alt=media&#x26;token=31cb3ed5-4c41-4bd2-94c7-b5a8956ed175" alt=""><figcaption></figcaption></figure>

As we can see, the request with the `username` parameter set to `apps` return a slightly different response, without the full stop. This means that the username worked which triggered different behaviour.&#x20;

Now, we have to fuzz the password. With the `username` parameter set to `apps`, add the payload filed to the `password` parameter.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FQpOLtccpr8KiBTZPtvF4%2F9.png?alt=media&#x26;token=e792773d-2cdd-4cd2-8f7d-406f9212979a" alt=""><figcaption></figcaption></figure>

In the `Payloads` tab, set the type to `Simple list` and paste the passwords provided to us.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FQiyyXKD5cJDwbQN5d3pk%2F10.png?alt=media&#x26;token=9de72649-3d24-49b6-a5cf-9901309bb5a9" alt=""><figcaption></figcaption></figure>

Let's start the attack.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FoppPK20wx240LqybAoFr%2F11.png?alt=media&#x26;token=2f7bebc3-c181-41bc-b927-e50b28426806" alt=""><figcaption></figcaption></figure>

The request where the `password` parameter was set to `1111` returned a 302 response. Now we can login using the fuzzed credentials:

| Username | Password |
| -------- | -------- |
| apps     | 1111     |

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FxPNMP5DO9PAlVWFPGSeq%2F12.png?alt=media&#x26;token=7147234e-04f7-463c-9da5-2681b59f1f3b" alt=""><figcaption></figcaption></figure>

We have solved the lab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FC2kaOc8Djiz3s6hVIftv%2F13.png?alt=media&#x26;token=2887fc56-caf6-49b4-946f-b9c547465de1" alt=""><figcaption></figcaption></figure>
