> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-authentication-labs/lab-1.md).

# lab-1

## Username Enumeration via Different Responses

**Difficulty:** Apprentice

### Lab Description

This lab is vulnerable to username enumeration and password brute-force attacks. It has an account with a predictable username and password.

**Wordlists:** [Candidate usernames](https://portswigger.net/web-security/authentication/auth-lab-usernames) · [Candidate passwords](https://portswigger.net/web-security/authentication/auth-lab-passwords)

**Objective:** Enumerate a valid username, brute-force their password, then access the account page.

### Solution

**Step 1 — Capture the login request**

Attempt a login with any wrong username and password. Capture the request in Burp Suite and send it to Intruder.

**Step 2 — Enumerate the username**

Set the username field value as the only Intruder payload position. Load the candidate username wordlist as the payload and start the attack.

Once finished, sort the results by **response length**. One response will be noticeably different from the rest — its error message reads *"Incorrect password"* rather than *"Invalid username or password"*. The username that produced this different response is valid.

**Step 3 — Brute-force the password**

Set the username to the one just discovered, then move the payload position to the password field. Load the candidate password wordlist and start the attack again.

Sort the results by response length (or status code). The correct password produces a `302` redirect or a noticeably different response length, revealing the valid credentials.

### Conclusion

The application leaked information about whether a username existed by returning a subtly different error message. This distinction was enough to enumerate valid accounts before the password attack even began.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-authentication-labs/lab-1.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.