PortSwigger Academy: Exploiting Broken Brute-Force Protection via Multiple Credentials per Request

1. 1Identify web applications with rate-limiting defenses
2. 2Analyze the application's authentication mechanism to determine if it's vulnerable to multiple credentials per request
3. 3Configure a tool like Burp Suite to send multiple credentials in a single request
4. 4Test the application's response to multiple credentials and observe if the rate-limiting defense is bypassed
5. 5Apply this technique to exploit broken brute-force protection and gain unauthorized access

Security teams and penetration testers can benefit from understanding this technique to identify vulnerabilities in web applications and improve their security posture. Developers can also learn from this to strengthen their application's brute-force protection

💡 Sending multiple credentials in a single request can bypass rate-limiting defenses in web applications, allowing attackers to brute-force passwords without being blocked

🚨 Exploit broken brute-force protection by sending multiple credentials per request! 💡