Lab: Broken brute-force protection, IP block
Summary: PortSwigger's lab describes a login page that temporarily blocks an IP after 3 incorrect logins in a row, but resets that failed-attempt counter when the attacker logs in to their own account before the limit is reached. The solution sends a pitchfork Intruder attack with maximum concurrent requests set to 1, alternating the attacker's username with carlos at least 100 times and placing the attacker's own password before each candidate password, then filters out 200 responses to find the single 302 for carlos.
Key Takeaway: The brute-force protection here counts failures per IP but clears the count on any successful login, so an attacker with one valid account can keep guessing indefinitely - the lab's own payload list repeats carlos at least 100 times without ever tripping the block.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026