Broken Authentication - Username Enumeration via Account Lock
Support This Channel
======================
Please like and subscribe, it means a lot!
Please buy me a coffee so I can continue to make content.
https://buymeacoffee.com/zenshell
My cybersec and webdev training site
https://www.zenshell.ninja
Join our Discord
/ discord
This lab will lock accounts after too many failed login attempts. Although login is prevented, the app still provides different responses depending on whether the username is valid and whether the password is correct. This allows for both username enumeration and brute forcing of the password despite the account in question technically being locked for logins.