← Back to Dashboard

🔨 Brute Force Vulnerability

Login page with no rate limiting or account lockout

📊 Login Attempts: 0 (No limit!) 🔄 Reset Counter

Login Form

🔓 Security Weaknesses:

  • ❌ No rate limiting
  • ❌ No account lockout
  • ❌ No CAPTCHA
  • ❌ No delay between attempts
  • ❌ Username enumeration possible
  • ❌ No 2FA

Common Passwords to Try:

admin password 123456 password123 admin123 letmein qwerty welcome 12345678

🎯 Vulnerability Info

Type: Brute Force / No Rate Limiting

Severity: Medium

💡 How to Exploit

  • No protection against multiple login attempts
  • Use automated tools to try many passwords
  • Username enumeration reveals valid users

🔧 Burp Suite Intruder

  1. Capture login POST request
  2. Send to Intruder (Ctrl+I)
  3. Clear all positions, select password value
  4. Load password wordlist in Payloads
  5. Start Attack
  6. Look for different response length/status

🧪 Hydra Command

hydra -l admin -P /path/to/wordlist.txt \ localhost http-post-form \ "/vulnlab/vulnerabilities/brute-force/:username=^USER^&password=^PASS^:Invalid"

📝 Sample Wordlist

# Top passwords to try: admin123 password 123456 password123 letmein admin user123 guest qwerty123 welcome1

📚 Valid Users

  • admin
  • user
  • john
  • jane
  • guest