Guessing usernames for known users - Port Swigger
Summary: PortSwigger's Burp Intruder includes a built-in username generator that takes an input such as a name and produces candidate usernames from common patterns, returning combinations like carlos.montoya and mcarlos for the input Carlos Montoya. PortSwigger describes it as a more targeted way to enumerate usernames than a generic name list when details of a specific user, such as their name or email address, are known but the exact username is not.
What you should know: A tool that turns one known name into a short list of likely usernames makes account enumeration cheap for anyone who already knows something about a target employee, and the accompanying Web Security Academy lab on username enumeration via different responses shows the technique is taught to be tested against live login pages.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026