📄️ Lab 1 - Username Enumeration via different responses
Step-by-step PortSwigger lab walkthrough showing how differing server responses reveal valid usernames and enable password brute-force. Learn the Burp Intruder setup, payload lists, detection techniques, and mitigation recommendations.
📄️ Lab 2 - Username Enumeration via subtly different responses
Step-by-step PortSwigger lab walkthrough demonstrating how subtly different server responses allow username enumeration and password brute-force. Includes Burp Intruder setup, payload lists, detection techniques, and mitigations.
📄️ Lab 3 - Username Enumeration via response timing
Step-by-step PortSwigger lab walkthrough demonstrating timing side-channel username enumeration, Burp Repeater/Intruder setup, rate-limit bypassing techniques, and mitigations.
📄️ Lab 4 - Broken Brute-Force Protection, IP Block
Step-by-step PortSwigger lab walkthrough demonstrating how improper brute-force protections can be bypassed by resetting rate-limits on successful auth and how to exploit that to brute-force a target account.
📄️ Lab 5 - Username Enumeration via account lock
Step-by-step PortSwigger lab walkthrough demonstrating how account-lock behavior can leak valid usernames, Burp Intruder Cluster Bomb usage to trigger the side-channel, and remediation guidance.
📄️ Lab 6 - Broken Brute-Force Protection (multiple credentials)
Step-by-step PortSwigger lab walkthrough demonstrating a JSON input validation flaw where multiple credentials in one request bypass brute-force protections. Shows Burp Repeater setup, JSON payload technique, and mitigations.
📄️ Lab 7 - 2FA Simple Bypass
Step-by-step PortSwigger lab walkthrough showing a simple 2FA enforcement bypass by manipulating the post-authentication URL. Covers Burp Repeater, email OTP retrieval, and remediation steps.
📄️ Lab 8 - 2FA Broken Login
Step-by-step PortSwigger lab walkthrough demonstrating a broken 2FA flow that trusts client-supplied challenge identifiers and lacks OTP brute-force protection; shows cookie tampering and Intruder brute-force technique, plus mitigations.
📄️ Lab 9 - 2FA Bypass using a brute-force attack
Step-by-step PortSwigger lab walkthrough demonstrating a 2FA bypass via brute-forcing 4-digit OTPs by tampering identity cookies and using Burp Intruder. Includes detection of 302 success redirects and mitigation guidance.
📄️ Lab 10 - Brute-forcing a Stay-logged-in Cookie
Step-by-step PortSwigger lab walkthrough demonstrating how to exploit weak stay-logged-in cookie implementation through base64 and MD5 hash decoding, password brute-forcing with Burp Intruder, and account takeover. Learn cookie encoding vulnerabilities and mitigation strategies.
📄️ Lab 11 - Offline Password Cracking
Step-by-step PortSwigger lab walkthrough demonstrating XSS exploitation to steal stay-logged-in cookies, offline password cracking through base64 and MD5 decoding, and account takeover. Learn how to combine XSS vulnerabilities with weak authentication mechanisms.
📄️ Lab 12 - Password Reset Broken Logic
Step-by-step PortSwigger lab walkthrough demonstrating broken password reset logic exploitation. Learn how flawed parameter validation in password reset functionality enables unauthorized account takeover.
📄️ Lab 13 - Password Brute-Force via Password Change
Step-by-step PortSwigger lab walkthrough demonstrating password brute-force through flawed password change logic. Learn how verbose error messages in password change functionality enable password enumeration and account takeover.