Summary of "Username enumeration via different responses (Video solution, Audio)"

Overview

The video tutorial demonstrates how to solve a lab challenge involving username enumeration via different server responses using Burp Suite. The lab is at an apprentice level and requires:

Enumerating a valid username
Brute forcing the password
Accessing the user’s account page

Key Technological Concepts and Tools

Username enumeration by analyzing differences in HTTP response lengths and messages.
Using Burp Suite as the primary tool, including:
- Proxying traffic through Burp.
- Using the HTTP history to capture login requests.
- Sending login POST requests to Burp Intruder for automated testing.
- Configuring Intruder with the Sniper attack type.
- Marking the username and password parameters as payload positions.
- Loading candidate username and password lists as payloads.
- Detecting valid usernames by observing differences in response length and content (e.g., “incorrect password” vs. “invalid username”).
- Identifying valid passwords similarly by response length and content differences.

Product Features and Workflow

Burp Suite’s Intruder allows automated injection of payloads into specified parameters.
The Payloads tab supports loading and managing lists of usernames and passwords.
Sorting responses by length helps identify anomalies indicating valid credentials.
The tutorial emphasizes careful observation of response messages to distinguish between invalid usernames and incorrect passwords.

Step-by-step Guide Summary

Proxy traffic through Burp and disable intercept.
Capture a login POST request in HTTP history.
Send the request to Intruder.
Clear default payload positions, then mark the username parameter.
Load a candidate username list as payloads.
Start the attack and analyze response lengths and content.
Identify valid usernames based on unique responses (e.g., “incorrect password” message).
Clear payload positions, mark the password parameter, and fix the username to the valid one.
Load a candidate password list as payloads.
Start the attack and analyze responses to find the valid password.
Use the valid username and password to log in and solve the lab.