BACKGROUND

This lab is vulnerable due to a logic flaw in its password brute-force protection. To solve the lab, brute-force the victim's password, then log in and access their account page.

Your credentials: wiener:peter
Victim's username: carlos
Candidate passwords

EXPLOITATION

Mesage with incorrect password and existent username

Incorrect password

When username doesn't exist:

Invalid username

it has rate limiting but it can be bypassed by entering a correct username between 2 or 3 incorrect request.