PortSwigger Lab #1 — Username Enumeration via Different Responses

1. 1Set up Burp Intruder with two wordlists to brute-force usernames
2. 2Configure Burp Intruder to analyze response lengths for differences
3. 3Run the attack and identify responses with unique lengths
4. 4Analyze the results to determine if username enumeration is possible
5. 5Test the findings to confirm the vulnerability

Security testers and penetration testers can benefit from this technique to identify vulnerabilities in web applications

💡 Different response lengths can indicate the presence of a username enumeration vulnerability

Identify username enumeration vulnerabilities with Burp Intruder and response length analysis