> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/authentication/username-enumeration-via-response-timing.md).
# 通过响应时间进行用户名枚举
通过响应时间进行用户名枚举，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 通过响应时间进行用户名枚举
这个实验室存在基于响应时间的用户名枚举漏洞。要解决它，你需要识别出一个有效用户名，对你的密码进行原始暴力破解攻击，然后访问你的账户页面。
```bash
你的凭据：wiener:peter
```
### **初步分析**
当测试大量密码时，应用程序会显示一条错误消息，指出检测到了过多尝试。
为绕过此保护，添加以下请求头：
```bash
X-Forwarded-For: 127.0.0.2
```
### **响应时间测量**
发送一个带有极长 **密码** 针对用户 `wiener`:
{% code overflow="wrap" %}
```bash
username=wiener&password=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
```
{% endcode %}
然后可以观察到该响应大约需要 **3 秒** 才返回。
另一方面，如果使用无效用户名\*\*发送同样的请求，响应则是 **几乎瞬时**:
```bash
username=dwdwd&password=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
```
因此，这种差异使得可以区分有效 **用户名** 和无效用户。
#### **使用 Intruder 生成列表**
在 Intruder 中，我们使用 **Pitchfork** 技术。
* 第一个位置： **待测试用户名列表** 要测试
第二个位置： **不同的 IP 地址列表** 发送到 `X-Forwarded-For`
该字段 **响应完成** 被分析：
与有效用户关联的响应耗时显著更高（Apache 显示的值大得多）。
这使我们能够识别正确的用户。
#### \*\* 暴力破解密码强度\*\*
找到有效用户名后，你开始对密码发起攻击。
我们注意到，密码为 **chelsea** 的尝试会产生不同的响应：一个 **302 Found**，这表明身份验证成功。
随后确认已可访问该账户。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/authentication/username-enumeration-via-response-timing.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
