Writeup: Broken brute-force protection, multiple credentials per request
Lab link.
When we send the request, we see that it goes in JSON format and if we make a certain number of mistakes, we are blocked from IP.
By sending more than one password in the JSON structure, we can achieve a successful login. We bring our passwords to JSON structure with Sublime text editor.
We obtain the successful input and right-click on the response, copy and paste “show response in browser” into the browser.
