> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-authentication-labs/lab-6.md).

# lab-6

## Broken Brute-Force Protection, Multiple Credentials per Request

**Difficulty:** Expert

### Lab Description

This lab is vulnerable due to a logic flaw in its brute-force protection. The backend accepts login credentials in JSON format and, critically, validates a password field that contains an array of values.

**Victim's username:** `carlos`\
**Wordlist:** [Candidate passwords](https://portswigger.net/web-security/authentication/auth-lab-passwords)

**Objective:** Brute-force Carlos's password and access their account page.

### Solution

**Step 1 — Identify the JSON login format**

Attempt a login as `carlos` with a wrong password and capture the request in Burp. Inspect the body — credentials are sent in JSON format:

```json
{"username": "carlos", "password": "wrongpassword"}
```

Send this to Repeater.

**Step 2 — Test array input**

The backend's brute-force protection counts individual HTTP requests. The flaw here is that the application processes the `password` field even when it's an array, validating each value in turn. This means every password from the wordlist can be tested in a single HTTP request — the rate limiter sees only one request while the server checks dozens of passwords.

Test this by replacing the password string with a small array:

```json
{"username": "carlos", "password": ["test1", "test2", "test3"]}
```

If the response indicates validation is happening (rather than an immediate format error), the array technique works.

**Step 3 — Generate the password array**

Writing the full wordlist by hand isn't practical. Use this Python script to format the password file as a JSON array:

```python
input_file = "passwords.txt"
print("[")
with open(input_file, "r") as f:
    for line in f:
        password = line.strip()
        if password:
            print(f'"{password}",')
print("]")
```

**Step 4 — Send the batched request**

Paste the generated array as the value of the `password` key in the JSON body:

```json
{"username": "carlos", "password": ["password1", "password2", "password3", ...]}
```

Send the request. If the correct password is anywhere in the array, the server authenticates successfully and returns a `302` redirect.

**Step 5 — Use the session to access the account**

Since the correct password isn't known directly, use the session cookie from the `302` response to access Carlos's account. Copy the `Set-Cookie` value from that response, paste it into the browser as the active session, and navigate to `/my-account`.

### Conclusion

The application's brute-force protection only counted HTTP requests — not the number of credentials evaluated per request. Submitting a JSON array as the password field let the server test an entire wordlist in a single request, completely bypassing the rate limit.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-authentication-labs/lab-6.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.