Credential stuffing with Burp Suite - Port Swigger
Summary: PortSwigger's guide describes credential stuffing as a brute-force attack that logs into a site using known username and password pairs collected from earlier data breaches, relying on users reusing credentials across sites. Because each account is tried only once, account locking is effectively powerless against it, though rate limiting may still need to be bypassed, and the walkthrough uses Burp Suite's payload positions for username and password to spot valid logins through anomalous error messages, response times, or status codes such as a 302.
What's compelling: Account lockout, the control most teams count on against password guessing, does nothing here because each account is tried exactly once - so the only remaining barrier is rate limiting, which the source treats as something an attacker can work around.
Read the original at PortSwigger Research ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026