{"id":2509,"date":"2026-10-23T22:49:51","date_gmt":"2026-10-23T22:49:51","guid":{"rendered":"https:\/\/berenkudaygorun.com\/blog\/?p=2509"},"modified":"2026-10-24T13:55:01","modified_gmt":"2026-10-24T13:55:01","slug":"portswigger-authentication-lab-5-username-enumeration-via-response-timing","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2026\/10\/23\/portswigger-authentication-lab-5-username-enumeration-via-response-timing\/","title":{"rendered":"PortSwigger Authentication Lab 5: Username enumeration via response timing"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Bu labda, PortSwigger Web Security Academy\u2019nin Authentication kategorisindeki kullan\u0131c\u0131 ad\u0131 tespiti zafiyetini inceliyoruz. Giri\u015f denemelerine verilen yan\u0131t s\u00fcrelerindeki farkl\u0131l\u0131klardan yararlanarak ge\u00e7erli bir kullan\u0131c\u0131 ad\u0131 buluyor, ard\u0131ndan verilen parola listesini kullanarak brute force ile bu kullan\u0131c\u0131n\u0131n parolas\u0131n\u0131 tespit edip hesab\u0131na giri\u015f yapmaya \u00e7al\u0131\u015f\u0131yoruz. <a href=\"https:\/\/portswigger.net\/web-security\/authentication\/auth-lab-passwords\">Lab ba\u011flant\u0131s\u0131<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Evet, bu seferki labda, ad\u0131ndan anla\u015f\u0131laca\u011f\u0131 \u00fczere, s\u00fcreye g\u00f6re bizden asl\u0131nda enumerasyon yapmam\u0131z\u0131 bekliyorlar.<br>Scripti a\u015fa\u011f\u0131daki gibi haz\u0131rlad\u0131m.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1100\" height=\"913\" src=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-15.jpeg\" alt=\"\" class=\"wp-image-2526\" srcset=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-15.jpeg 1100w, https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-15-768x637.jpeg 768w\" sizes=\"auto, (max-width: 1100px) 100vw, 1100px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Anomali puan\u0131ndan da anla\u015f\u0131laca\u011f\u0131 \u00fczere, mysql username&#8217;inde, ayn\u0131 zamanda s\u00fcrelere de bakt\u0131\u011f\u0131m\u0131zda, b\u00fcy\u00fck bir farkl\u0131l\u0131k var.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1100\" height=\"913\" src=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-16.jpeg\" alt=\"\" class=\"wp-image-2525\" srcset=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-16.jpeg 1100w, https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-16-768x637.jpeg 768w\" sizes=\"auto, (max-width: 1100px) 100vw, 1100px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Username bu olabilir varsay\u0131m\u0131 ile bu sefer parola sald\u0131r\u0131s\u0131nda bulunuyorum.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1100\" height=\"913\" src=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-17.jpeg\" alt=\"\" class=\"wp-image-2528\" srcset=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-17.jpeg 1100w, https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-17-768x637.jpeg 768w\" sizes=\"auto, (max-width: 1100px) 100vw, 1100px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Ve sonu\u00e7&#8230;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1100\" height=\"913\" src=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-19.jpeg\" alt=\"\" class=\"wp-image-2529\" srcset=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-19.jpeg 1100w, https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-19-768x637.jpeg 768w\" sizes=\"auto, (max-width: 1100px) 100vw, 1100px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">302 ald\u0131\u011f\u0131m\u0131z credential&#8217;larla lab\u0131 \u00e7\u00f6z\u00fcyoruz.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ancak bunun haricinde bir \u00e7\u00f6z\u00fcm daha g\u00f6stermek istiyorum. Konu tamamen asl\u0131nda X-Forwarded-For ile alakal\u0131 oldu\u011fu i\u00e7in payla\u015fmak istedim. Lab i\u00e7erisine \u00e7e\u015fitli istekler g\u00f6nderdi\u011fimde, e\u011fer \u015fanss\u0131zsam threshold&#8217;lara tak\u0131labiliyordum. Mesela a\u015fa\u011f\u0131daki ekran g\u00f6r\u00fcnt\u00fcs\u00fc gibi:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1100\" height=\"650\" src=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-14.jpeg\" alt=\"\" class=\"wp-image-2524\" srcset=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-14.jpeg 1100w, https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-14-768x454.jpeg 768w\" sizes=\"auto, (max-width: 1100px) 100vw, 1100px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Bu tarz \u015feyleri bypass ederken, e\u011fer sadece IP bazl\u0131 k\u0131s\u0131tlama al\u0131nd\u0131ysa \u00e7e\u015fitli teknikler denenebilir. Bunlardan bir tanesi X-Forwarded-For. Bununla alakal\u0131 k\u0131sa bir an\u0131m\u0131 anlatmak isterim. Bir \u00fcr\u00fcn geli\u015ftiriyorduk ve bu \u00fcr\u00fcn\u00fcn ayn\u0131 zamanda IP loglamas\u0131 da yapmas\u0131 gerekiyordu. Ancak istekler \u00f6ncesinde sunucuya de\u011fil, bir load balancer&#8217;a geliyordu. Do\u011fal olarak backend&#8217;de \u00e7al\u0131\u015fan i\u00e7erideki sisteme istekler load balancer&#8217;dan geldi\u011fi i\u00e7in b\u00fct\u00fcn IP loglamalar\u0131 hep load balancer&#8217;\u0131n oluyordu. Peki bunu nas\u0131l \u00e7\u00f6zd\u00fck? \u0130\u015fte basit bir HTTP header&#8217;\u0131 asl\u0131nda sunucuya, \u201cBak, ben asl\u0131nda bu IP&#8217;den geliyordum,\u201d diyebiliyordu. Yaz\u0131l\u0131mc\u0131 olarak bakarsan\u0131z \u201cSorunu \u00e7\u00f6zd\u00fcm, harika,\u201d diyebilirsiniz. G\u00fcvenlik\u00e7i olarak bakarsan\u0131z ise d\u00fc\u015f\u00fcnceniz \u201cEyvah,\u201d olmal\u0131&#8230;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u015eimdi iste\u011fe k\u00fc\u00e7\u00fck bir de\u011fer ekleyelim ve tekrar sonuca bakal\u0131m.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1100\" height=\"650\" src=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-13.jpeg\" alt=\"\" class=\"wp-image-2523\" srcset=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-13.jpeg 1100w, https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-13-768x454.jpeg 768w\" sizes=\"auto, (max-width: 1100px) 100vw, 1100px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Evet, art\u0131k brute force&#8217;u tekrarlayabiliriz. A\u015fa\u011f\u0131daki scripti kulland\u0131m.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1100\" height=\"845\" src=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-18.jpeg\" alt=\"\" class=\"wp-image-2527\" srcset=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-18.jpeg 1100w, https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-18-768x590.jpeg 768w\" sizes=\"auto, (max-width: 1100px) 100vw, 1100px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Bu lab \u00f6zelinde, bu \u015fekilde de asl\u0131nda kesintisiz bir \u015fekilde brute force i\u015flemi yap\u0131labilirdi.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Bu labda, PortSwigger Web Security Academy\u2019nin Authentication kategorisindeki kullan\u0131c\u0131 ad\u0131 tespiti zafiyetini inceliyoruz. Giri\u015f denemelerine verilen yan\u0131t s\u00fcrelerindeki farkl\u0131l\u0131klardan yararlanarak ge\u00e7erli bir kullan\u0131c\u0131 ad\u0131 buluyor,&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/berenkudaygorun.com\/blog\/blog\/2026\/10\/23\/portswigger-authentication-lab-5-username-enumeration-via-response-timing\/\">Devam\u0131n\u0131 oku<span class=\"screen-reader-text\">PortSwigger Authentication Lab 5: Username enumeration via response timing<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[749],"tags":[393],"class_list":["post-2509","post","type-post","status-publish","format-standard","hentry","category-web","tag-authentication","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2509","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=2509"}],"version-history":[{"count":2,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2509\/revisions"}],"predecessor-version":[{"id":2531,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2509\/revisions\/2531"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=2509"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=2509"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=2509"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}