Welcome to this intentionally vulnerable training application.
Objective: Username enumeration through inconsistent authentication responses. Inspect requests and responses with Burp Suite or browser developer tools. Use only the synthetic accounts and data supplied here.
Do not attack the arena portal or any system outside this lab.
Starting point: undefined
Scenario: Northstar Analytics has received reports that its employee portal may reveal whether a username exists. You have written authorization to assess this synthetic training application only.
Objective: identify a valid demo username by comparing login responses, then determine its password using the supplied small candidate lists. Sign in to the synthetic account to complete the lab.
Method: capture the POST request in Burp Suite, send it to Repeater to establish a baseline, then use Intruder with the provided candidate files. Compare response text and length; do not use external accounts or large wordlists.