> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/authentication/username-enumeration-via-response-timing.md).
# 通过响应时间进行用户名枚举
### 通过响应时间进行用户名枚举
该实验室存在基于响应时间的用户名枚举漏洞。要解决它，你需要识别出一个有效用户名，对密码进行原始暴力破解攻击，然后访问你的账户页面。
```bash
你的凭据：wiener:peter
```
### **初步分析**
在测试大量密码时，应用程序会显示一条错误信息，提示检测到过多的尝试次数。
为绕过此保护，添加以下请求头：
```bash
X-Forwarded-For: 127.0.0.2
```
### **响应时间测量**
发送一个带有极长 **密码** 用于用户 `wiener`:
{% code overflow="wrap" %}
```bash
username=wiener&password=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
```
{% endcode %}
随后观察到响应大约需要 **3 秒** 才到达。
另一方面，如果使用无效用户名发送相同的请求，响应则是 **几乎瞬时**:
```bash
username=dwdwd&password=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
```
因此，这种差异使得可以区分有效的 **username** 与无效的。
#### **使用 Intruder 进行列表**
在 Intruder 中，我们使用 **Pitchfork** 技术。
* 第一个位置： **用户名** 待测试
第二个位置： **不同的 IP 地址** 发送到 `X-Forwarded-For`
字段 **响应完成** 进行分析：
与有效用户关联的响应具有显著更高的时间（Apache 显示的值要大得多）。
这使得可以识别出正确的用户。
#### \*\*暴力破解密码强度\*\*
找到有效用户名后，你开始对密码发起攻击。
我们注意到，使用密码 **chelsea** 会产生不同的响应：一个 **302 Found**，这表明认证成功。
随后确认可以访问该账户。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/authentication/username-enumeration-via-response-timing.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.