Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Bug on "Lab: Username enumeration via account lock"

Eren | Last updated: Jun 01, 2022 09:04PM UTC

Hello, I tried every way to solve the lab but I couldn't get any results. I think there is something wrong with some labs. I faced the same problem before. Should i send email to support's mail?

Liam, PortSwigger Agent | Last updated: Jun 02, 2022 05:59AM UTC

Thanks for your message. Have you tried following the community solution?

Eren | Last updated: Jun 02, 2022 02:02PM UTC

Yeah i tried everything. Your solution, community solution and other sources. So, you can reset the labs or you will accept the labs like solved. How it will happen?

Liam, PortSwigger Agent | Last updated: Jun 03, 2022 06:57AM UTC

The labs are passing in our testing. Are you still encountering this issue?

Eren | Last updated: Jun 03, 2022 05:21PM UTC

Yeah its still there. I send ss about this. https://img.ssyukle.com/image/NNOJ83 https://img.ssyukle.com/image/NNONhy

Sepsev | Last updated: Jun 03, 2022 09:42PM UTC

Hello. I'm experiencing the same issue as well. According to step 4 of the community solution, we should receive a message about the account being locked in the response once we've exceeded the failed attempts threshold for a single account. Step 4 says the following verbatim... "In the results, notice that the responses for one of the usernames were longer than responses when using other usernames. Study the response more closely and notice that it contains a different error message: You have made too many incorrect login attempts. Make a note of this username." I ran a sniper attack with Intruder using the valid "Wiener" username and all 100 candidate passwords (none of which was the correct password) as the payload. None of the responses returned, "You have made too many incorrect login attempts" and all responses had the same exact length. This was a test to confirm we are not exceeding the failed attempt threshold. Without a set threshold, we cannot progress through the remaining steps for the "Username enumeration via account lock" lab.

Ben, PortSwigger Agent | Last updated: Jun 07, 2022 07:19AM UTC

Hi, On a general note, If you are using Burp Community then we would recommend that you split up your attacks into smaller subsets in order to better handle the throttling that occurs within Intruder in this edition of Burp i.e. break the usernames down into smaller sets and run multiple attacks. @Sepsev, have you tried running through the initial steps of the solution rather than attempting your approach - 'wiener' is not a valid username for this particular lab.

Nebiyu | Last updated: Jan 08, 2023 06:40PM UTC

Hello, I am having the same problem too. At step 4 of the community solution, I am supposed to get "You have made too many incorrect login attempts." error message at which the user name is valid. However, I am getting the same error for all user names which is "Invalid username or password.", which implies there is no valid username in the list. I use community edition, also checked on professional trial version, result is same. I am a newbie and need a little help.

Ben, PortSwigger Agent | Last updated: Jan 09, 2023 08:15AM UTC

Hi Nebiyu, I have just run through this lab and been able to retrieve a response that has a greater length than the others (and which contains the 'You have made too many incorrect login attempts' error message) so it does appear to be working as expected. Are you able to share some screenshots of the steps that you are going through to try and solve this lab - you can send these via email to support@portswigger.net and we can take a look from there.

Katie | Last updated: Jan 19, 2023 02:29AM UTC

I think I MIGHT know the issue. The login attempt counter resets after a minute or so. If you are using the community version of Burp, it takes much longer to run an Intruder attack. I had the same problem and then ran through the process again, but only 5 usernames in the Intruder attack at a time until I found the correct username. This shouldn't be an issue if pro since it runs the payloads so quickly.

池田滉志朗 | Last updated: Nov 22, 2023 01:45PM UTC

For those who spent so much time for this LAB with Community Edition. "If you are using Burp Community then we would recommend that you split up your attacks into smaller subsets in order to better handle the throttling that occurs within Intruder in this edition of Burp i.e. break the usernames down into smaller sets and run multiple attacks. " -> This tips worked!! Like 20 - 30 username I selected from Candidate username .

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.