The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Username enumeration via account lock guidance

Darin | Last updated: Aug 29, 2020 07:54AM UTC

I have tried to solve this lab. I have created attack in intruder with a counter that I go through each username 5 times with bad password. I don't see any difference in the length of the return. I also have done a grep and pulled out the "is-warning". It does not seem to change for any of the results. Is there something else I can check for a difference?

Uthman, PortSwigger Agent | Last updated: Sep 01, 2020 11:47AM UTC