Lab: Password brute-force via password change
Summary: PortSwigger's lab demonstrates that a password change function can be vulnerable to brute-force attacks, and the exercise asks the user to brute-force Carlos's account using a list of candidate passwords to reach his "My account" page. The walkthrough directs the user to set the username parameter to carlos in Burp Intruder, add a payload position to the current-password parameter, and set the two new password parameters to different values.
Key Takeaway: A password change form that accepts unlimited guesses against the current password turns an authenticated feature into a credential-guessing surface, so the control that matters is rate limiting and lockout on that endpoint, not just on the login page.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026