TryHackMe: Enumeration & Bruteforce — Room Walkthrough
In cybersecurity, data about a system's users, services, and vulnerabilities can often be uncovered through enumeration and brute-force attacks. This writeup covers my walkthrough of the Enumeration & Bruteforce room on TryHackMe, where I practiced enumerating usernames through verbose errors, exploiting weak password reset logic, and brute-forcing HTTP Basic Authentication — all backed by Burp Suite and some custom scripting.
Authentication Enumeration
Authentication enumeration is the process of probing a web application's login mechanisms to identify legitimate usernames — often the first step before a targeted password attack. Once a username is confirmed valid, all further effort can focus purely on cracking that one account's password.
Common enumeration surfaces: registration pages, password reset features, verbose error messages, and leaked breach data. This room focuses on verbose errors.
Setup — mapping the target
sudo nano /etc/hosts
# add:
10.10.88.12 enum.thm
Enumerating Users via Verbose Errors
Target: http://enum.thm/labs/verbose_login/
The login form returns different error messages depending on whether the username exists versus whether the password is wrong — a classic verbose-error leak that allows enumeration without ever needing a real password.
TryHackMe provided a Python script (script.py) to automate this check. I paired it with a public wordlist: nyxgeek/username-lists.
python3 script.py usernames_gmail.com.txt
Scrolling through the output, most entries come back [INVALID] — until the script hits a real account:
Exploiting Vulnerable Password Reset Logic
Target: http://enum.thm/labs/predictable_tokens/ — a small demo app called VulnApp.
The vulnerability exploited here is a predictable reset token. If the token in a password reset link is short or sequential, it can be brute-forced directly — no access to the victim's inbox required.
Steps
Triggered a reset for canderson@gmail.com on VulnApp's "Forgot Password" page — the app confirmed the link was sent:
Opened the reset URL through Burp, sent it to Intruder, and marked the token parameter as the payload position:
Generating the token wordlist with crunch
crunch 3 3 -o otp.txt -t %%% -s 100 -e 200Generates every 3-digit value from 100–200 (101 candidates) — a fast, targeted list.
Result
Every failed guess returned a consistent 1068-byte response — except one:
| Request | Token | Status | Length |
|---|---|---|---|
| 27 | 126 | 200 | 1131 (anomalous) |
Exploiting HTTP Basic Authentication
Target: http://enum.thm/labs/basic_auth/
HTTP Basic Auth sends credentials Base64-encoded (not encrypted) in the Authorization header, with no built-in lockout — making it a solid brute-force target.
Steps
- Submitted a random guess to capture a request in Burp.
- Captured header:
Authorization: Basic YWRtaW46dHJ5cGFzcw== - Used Burp's right-click Convert selection → Base64 menu to verify the decode/encode round trip before wiring up the attack:
- Sent to Intruder with a password wordlist prefixed
admin: - Added a payload processing rule to Base64-encode each guess before sending
- Removed
=from Burp's URL-encoding character set to preserve Base64 padding correctly - Filtered results for Status 200 (failed attempts returned 401)
Logging in with the recovered credentials granted access, and the flag was displayed directly on the page:
OSINT (Open-Source Intelligence)
The final task shifts from active attacks to passive reconnaissance. OSINT collects data from publicly available sources to build a target profile that fuels phishing, social engineering, or credential-stuffing.
- Social media — staff/user info useful for password or security-question guessing
- Data breaches — checking if a username/email appeared in a known leak
- WHOIS — domain registration and ownership details
- Wayback Machine — historical site snapshots, sometimes revealing forgotten endpoints
- waybackurls — bulk-extracts archived URLs for a domain
- Google Dorks — crafted queries that surface exposed admin panels or leaked files never meant to be indexed
As a demonstration, I pulled up the Wayback Machine archive for tryhackme.com — 785 snapshots saved between December 2018 and June 2024:
OSINT doesn't exploit anything directly — it feeds better context and higher-quality targets into every other technique above.
Conclusion
This room ties together three practical techniques: verbose error enumeration to confirm valid usernames, predictable token brute-forcing to fully take over an account via a weak reset flow, and HTTP Basic Auth brute-forcing using Burp Intruder with Base64 payload processing.
The common thread: authentication systems leak far more than they should through error messages, weak token entropy, and unthrottled login attempts — all fixable with generic error responses, cryptographically random tokens, and rate limiting.