← Feed

Posts

• View post

  In cass it's not clear from other comments, if the site tells you either one's wrong but not both, you can then brute force and try out a bunch of usernames and passwords to effectively farm for both: those that say "wrong username" means that the password is valid, while those that say "wrong password" means you got the username that's in the system. Once you've collected them, the rest is just trying out every password for every user. So... while this seem...