Authentication lab usernames

Summary: PortSwigger Research published a list of usernames for use in Burp Intruder to help solve its Web Security Academy authentication labs. The list begins with common account names such as carlos, root, admin, test, guest, info, adm, mysql, user, administrator, oracle, ftp, pi, puppet, ansible, ec2-user, vagrant, azureuser and academico, then continues through a long alphabetical set of candidate usernames.
Why it matters: The list is built from the default and service account names that appear across real systems - root, admin, administrator, mysql, oracle, ftp, puppet, ansible, ec2-user, vagrant, azureuser - which is exactly the set an attacker tries first when enumerating usernames against your login endpoints.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026