Broken Authentication - Username Enumeration via Account Lock

Support This Channel
======================
Please like and subscribe, it means a lot!
Please buy me a coffee so I can continue to make content.
buymeacoffee.c...
My cybersec and webdev training site
www.zenshell.n...
Join our Discord
/ discord
This lab will lock accounts after too many failed login attempts. Although login is prevented, the app still provides different responses depending on whether the username is valid and whether the password is correct. This allows for both username enumeration and brute forcing of the password despite the account in question technically being locked for logins.

[@alex-v7e6v]

probably the best educational channel I've ever seen. Hard to explain with words how cool this is. Thank you very very much

[@GilligansTravels]

do you have the script for that handy for share?