{"id":2543,"date":"2026-10-26T16:53:19","date_gmt":"2026-10-26T16:53:19","guid":{"rendered":"https:\/\/berenkudaygorun.com\/blog\/?p=2543"},"modified":"2026-10-26T16:53:21","modified_gmt":"2026-10-26T16:53:21","slug":"portswigger-authentication-lab-7-username-enumeration-via-account-lock","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2026\/10\/26\/portswigger-authentication-lab-7-username-enumeration-via-account-lock\/","title":{"rendered":"PortSwigger Authentication Lab 7: Username Enumeration via Account Lock"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Bu labda, PortSwigger Web Security Academy\u2019nin Authentication kategorisindeki hesap kilitleme mekanizmas\u0131n\u0131 inceliyoruz. Bu mekanizmadaki mant\u0131k hatas\u0131ndan yararlanarak ge\u00e7erli bir kullan\u0131c\u0131 ad\u0131n\u0131 tespit ediyor, ard\u0131ndan bu kullan\u0131c\u0131n\u0131n parolas\u0131n\u0131 brute force y\u00f6ntemiyle bulup hesab\u0131na giri\u015f yapmaya \u00e7al\u0131\u015f\u0131yoruz. <a href=\"https:\/\/portswigger.net\/web-security\/authentication\/password-based\/lab-username-enumeration-via-account-lock\">Lab ba\u011flant\u0131s\u0131<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Selamlar, yeni bir lab \u00e7\u00f6z\u00fcm\u00fc ile beraberiz. Buna benzer bulgular\u0131 daha \u00f6nceki raporlar\u0131mda yazm\u0131\u015ft\u0131m. Bana ne kadar dahice gelse de yaz\u0131l\u0131mc\u0131lar\u0131 ikna etmek bazen zor olabiliyor.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u015e\u00f6yle bir senaryo d\u00fc\u015f\u00fcn\u00fcn. Yaz\u0131l\u0131mc\u0131, bir hesaba belirli bir de\u011ferden fazla login iste\u011fi g\u00f6nderildi\u011finde g\u00fcvenlik gere\u011fi o hesab\u0131 kilitliyor. Ancak burada ufak bir sorun var. \u015eimdi yaz\u0131l\u0131mc\u0131 gibi d\u00fc\u015f\u00fcnelim ve kilitleme yapmadan \u00f6nce do\u011fal olarak hesab\u0131n kontrol\u00fcn\u00fc yapmal\u0131y\u0131z ve bir hesab\u0131 kilitlemek i\u00e7in elimizde gelen istek i\u00e7erisinde o hesaba ait sadece username var. E\u011fer kilitleme mod\u00fcl\u00fc user tablosundan ayr\u0131 \u00e7al\u0131\u015fmazsa, sald\u0131rgan bir enumeration yapabilir. H\u00e2lihaz\u0131rda sadece var olan hesaplar kilitlenebilece\u011fi i\u00e7in sald\u0131rgan bu y\u00f6ntemle asl\u0131nda sistemde var olan valid kullan\u0131c\u0131lar\u0131 tespit etmi\u015f olacakt\u0131r.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Bunu \u015fu \u015fekilde deneyebiliriz. Her kullan\u0131c\u0131 i\u00e7in ayn\u0131 olan 5 login iste\u011fi ataca\u011f\u0131z ve hangi hesapta kilitlenme oldu\u011funu anlamaya \u00e7al\u0131\u015faca\u011f\u0131z. Bunun i\u00e7in ben Turbo Intruder\u2019\u0131 kulland\u0131m.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1280\" height=\"1137\" src=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-23.jpeg\" alt=\"\" class=\"wp-image-2544\" srcset=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-23.jpeg 1280w, https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-23-768x682.jpeg 768w\" sizes=\"auto, (max-width: 1280px) 100vw, 1280px\" \/><figcaption class=\"wp-element-caption\">Screenshot<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Yukar\u0131daki resimde g\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere 5 kere ayn\u0131 username ile deneme yap\u0131l\u0131yor. Sonu\u00e7lara bakal\u0131m.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1280\" height=\"1137\" src=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-26.jpeg\" alt=\"\" class=\"wp-image-2547\" srcset=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-26.jpeg 1280w, https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-26-768x682.jpeg 768w\" sizes=\"auto, (max-width: 1280px) 100vw, 1280px\" \/><figcaption class=\"wp-element-caption\">Screenshot<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Anomaly Rank de\u011ferine zaten bak\u0131p direkt yorum yap\u0131labilir. Di\u011fer isteklerde Invalid username or password derken app01 i\u00e7in verdi\u011fi hata yukar\u0131daki g\u00f6rseldeki gibi.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u015eimdi elimizdeki parola wordlisti ile bu sefer login i\u00e7in brute force yapal\u0131m.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1280\" height=\"1137\" src=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-24.jpeg\" alt=\"\" class=\"wp-image-2545\" srcset=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-24.jpeg 1280w, https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-24-768x682.jpeg 768w\" sizes=\"auto, (max-width: 1280px) 100vw, 1280px\" \/><figcaption class=\"wp-element-caption\">Screenshot<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Bu sefer scriptimiz yukar\u0131daki gibidir. Sonu\u00e7 ise a\u015fa\u011f\u0131daki gibi&#8230;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1280\" height=\"1137\" src=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-25.jpeg\" alt=\"\" class=\"wp-image-2546\" srcset=\"https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-25.jpeg 1280w, https:\/\/berenkudaygorun.com\/blog\/wp-content\/uploads\/2026\/10\/image-25-768x682.jpeg 768w\" sizes=\"auto, (max-width: 1280px) 100vw, 1280px\" \/><figcaption class=\"wp-element-caption\">Screenshot<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Anomaly Rank \u00e7ok iyi \u00e7al\u0131\u015f\u0131yor de\u011fil mi?<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Bu labda, PortSwigger Web Security Academy\u2019nin Authentication kategorisindeki hesap kilitleme mekanizmas\u0131n\u0131 inceliyoruz. Bu mekanizmadaki mant\u0131k hatas\u0131ndan yararlanarak ge\u00e7erli bir kullan\u0131c\u0131 ad\u0131n\u0131 tespit ediyor, ard\u0131ndan bu&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/berenkudaygorun.com\/blog\/blog\/2026\/10\/26\/portswigger-authentication-lab-7-username-enumeration-via-account-lock\/\">Devam\u0131n\u0131 oku<span class=\"screen-reader-text\">PortSwigger Authentication Lab 7: Username Enumeration via Account Lock<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[749],"tags":[393],"class_list":["post-2543","post","type-post","status-publish","format-standard","hentry","category-web","tag-authentication","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2543","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=2543"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2543\/revisions"}],"predecessor-version":[{"id":2548,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2543\/revisions\/2548"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=2543"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=2543"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=2543"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}