> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-authentication-labs/lab-5.md).

# lab-5

## Username Enumeration via Account Lock

**Difficulty:** Practitioner

### Lab Description

This lab is vulnerable to username enumeration. It uses account locking as a brute-force defence, but this contains a logic flaw that can be exploited to identify valid usernames.

**Wordlists:** [Candidate usernames](https://portswigger.net/web-security/authentication/auth-lab-usernames) · [Candidate passwords](https://portswigger.net/web-security/authentication/auth-lab-passwords)

**Objective:** Enumerate a valid username, brute-force their password, then access the account page.

### Solution

**Step 1 — Understand account locking vs. IP blocking**

It's important to distinguish between two different defences:

* **IP blocking** — counts requests per IP address; blocks the *attacker's IP* regardless of which account is targeted.
* **Account locking** — counts failed attempts per *username*; locks the *account* after too many wrong passwords.

Account locking is useful for legitimate brute-force prevention, but it inadvertently leaks information: only *valid* usernames can be locked. Invalid usernames will never produce a lockout message.

**Step 2 — Trigger lockout on valid usernames**

Send the login request to Intruder and configure a **Cluster Bomb** attack with two payload positions — the username field and the password field.

* **Payload set 1 (username):** Load the full candidate username wordlist.
* **Payload set 2 (password):** Add 5 arbitrary wrong values (e.g. `1`, `2`, `3`, `4`, `5`).

The Cluster Bomb attack tests every username with each of the 5 wrong passwords. For a valid username, 5 consecutive wrong attempts will trigger the lockout threshold.

**Step 3 — Identify the locked account**

Go to **Settings → Grep Extract → Add → Fetch response** and extract the warning message element from the page. Start the attack.

When finished, sort the results by the extracted column. All invalid usernames return:

```
Invalid username or password.
```

The valid username returns a lockout message:

```
You have made too many incorrect login attempts. Please try again in 1 minute.
```

The username that produced this lockout response is the valid one.

**Step 4 — Brute-force the password**

Wait 1 minute for the lockout to expire, then update the username to the discovered one. Switch to **Sniper** attack mode with the password field as the only payload position. Load the candidate password wordlist and start the attack.

Sort by status code. A `302` redirect identifies the correct password.

### Conclusion

Account locking is intended to slow down brute-force attacks, but it creates a side-channel: the lockout message itself reveals that the targeted username is real. By deliberately hammering every username with multiple wrong passwords, valid accounts can be identified from the resulting lockout responses.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-authentication-labs/lab-5.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.