Username enumeration via different responses

Platform: PortSwigger | Category: Authentication | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, Authentication

Summary

Walkthrough of the PortSwigger Web Security Academy lab Username enumeration via different responses (Authentication). This lab demonstrates a authentication vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — Authentication

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

• Bruteforcing usernames
• Bruteforcing passwords
• Username enumeration ( Take note of status code error message & response times)

LAB 1 - Username enumeration via different responses

Lab Description :

Solution :

The login looks like this,

Captured request is as follows , it has two parameters - username and password

Now send the intercepted request to Intruder, clear all the selection & add username field. In the payload section, copy paste all the usernames in the given list.Click Start Attack.

Now we can see there is a entry which has different response & length. So ads is the username.

Now change the username to ads and add the password parameter .

Add the given payload in the payload section, Click Start Attack.

We get an entry which has different status code which is 302 redirection which indicates that login is successful and is redireting us to home page

username - ads password - zxcvbn

Key Takeaways / Lessons

• Understanding Authentication detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Username enumeration via different responses