In this video, we cover Lab #4 in the Authentication module of the Web Security Academy. This lab is subtly vulnerable to username enumeration and password brute-force attacks. It has an account with a predictable username and password, which can be found in the following wordlists: Candidate usernames: https://portswigger.net/web-security/authentication/auth-lab-usernames Candidate passwords: https://portswigger.net/web-security/authentication/auth-lab-passwords To solve the lab, we enumerate a valid username, brute-force this user's password, then access their account page. ▬ ✨ Support Me ✨ ▬▬▬▬▬▬▬▬▬▬ Buy my course: https://academy.ranakhalil.com/p/web-security-academy-video-series ▬ 📚 Contents of this video 📚 ▬▬▬▬▬▬▬▬▬▬ 00:00​​​ - Introduction 00:13 - Web Security Academy Course (https://bit.ly/30LWAtE) 01:24 - Navigation to the exercise 01:55 - Understand the exercise and make notes about what is required to solve it 02:32 - Exploit the lab 10:10 - Summary 10:34 - Thank You ▬ 🔗 Links 🔗 ▬▬▬▬▬▬▬▬▬▬ Notes.txt document: https://github.com/rkhal101/Web-Security-Academy-Series/blob/main/broken-authentication/lab-04/notes.txt Web Security Academy Lab Exercise: https://portswigger.net/web-security/authentication/password-based/lab-username-enumeration-via-subtly-different-responses Rana's Twitter account: https://twitter.com/rana__khalil