> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-authentication-labs/lab-2.md).

# lab-2

## Username Enumeration via Subtly Different Responses

**Difficulty:** Practitioner

### Lab Description

This lab is subtly vulnerable to username enumeration and password brute-force attacks. The difference in responses is much harder to spot than in a basic case.

**Wordlists:** [Candidate usernames](https://portswigger.net/web-security/authentication/auth-lab-usernames) · [Candidate passwords](https://portswigger.net/web-security/authentication/auth-lab-passwords)

**Objective:** Enumerate a valid username, brute-force their password, then access the account page.

### Solution

**Step 1 — Capture the login request**

Attempt a login with any wrong username and password. Capture the request in Burp Suite and send it to Intruder.

**Step 2 — Configure Grep Extract to catch subtle differences**

Before running the attack, set up response extraction to surface the tiny difference between responses. Go to **Settings → Grep Extract → Add → Fetch response**, then select the error message element:

```html
<p class=is-warning>Invalid username or password.</p>
```

This captures the exact text of the error message for each attempt.

**Step 3 — Enumerate the username**

Set the username field value as the only Intruder payload position. Load the candidate username wordlist and start the attack.

Once finished, sort by the extracted grep column. Every failed attempt returns:

```
Invalid username or password.
```

One attempt returns a message with a missing period at the end:

```
Invalid username or password
```

This tiny typographic difference is the enumeration signal — the username that produced it is valid.

**Step 4 — Brute-force the password**

Set the username to the discovered one, move the payload position to the password field, load the candidate password wordlist, and start the attack.

Sort by response length or status code to identify the correct password.

### Conclusion

The application returned two almost identical error messages — one with a trailing period and one without — depending on whether the username existed. This kind of subtle inconsistency is easily missed visually but trivially detected with Burp's grep extraction.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-authentication-labs/lab-2.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.