Lab: Username enumeration via subtly different responses
it returns error for both incorrect username and password
It just returns the username al
so i just used it for the username
since it returns different from the rest
Here i used the username al
with the password wordlist
and we got a redirect
solve it using burp
user al doesnt have 1
now just brute force for password and you will see a different status code
PreviousLab: Username enumeration via different responsesNextLab: Username enumeration via response timing
Last updated