Broken brute-force protection, multiple credentials per request

Platform: PortSwigger | Category: Authentication | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, Authentication

Summary

Walkthrough of the PortSwigger Web Security Academy lab Broken brute-force protection, multiple credentials per request (Authentication). This lab demonstrates a authentication vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — Authentication

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Another way websites try to prevent brute-force attacks is through user rate limiting. In this case, making too many login requests within a short period of time causes your IP address to be blocked. Typically, the IP can only be unblocked in one of the following ways:

• Automatically after a certain period of time has elapsed
• Manually by an administrator
• Manually by the user after successfully completing a CAPTCHA

As the limit is based on the rate of HTTP requests sent from the user's IP address, it is sometimes also possible to bypass this defense if you can work out how to guess multiple passwords with a single request.

Lab Description :

Solution :

Capture the request -> send to repeater

Here after sending the POST request to login page 3 times, it shows You have too many incorrect login attempts. Please try again after 1 minute , which means rate limiting is enabled.

Now we could see that the credentials are sent in JSON format

We can supply the given password list as array of passwords in JSON,

SCRIPT

for pass in $(cat password.txt); do echo \"$pass\",; done

In the aray of passwords , one of them is the valid password for carlos.

We get a 302 status code, which means we have logged in as carlos.

Key Takeaways / Lessons

• Understanding Authentication detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Broken brute-force protection, multiple credentials per request