Lab: Username enumeration via response timing
Summary: PortSwigger's lab is vulnerable to username enumeration through response timing, and solving it requires enumerating a valid username, brute-forcing that user's password, and accessing their account page. The lab also implements IP-based brute-force protection, which the text says can be easily bypassed by manipulating HTTP request headers.
What you should know: IP-based brute-force protection is only as strong as the request headers it trusts, and a login that answers faster for valid usernames than invalid ones hands an attacker the first half of the credential pair before any password guessing begins.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026