## Apprentice Level - ✅ [[1. Username enumeration via different responses]] - ✅ [[2. 2FA simple bypass]] - ✅ [[3. Password reset broken logic]] ## Practitioner Level - ✅ [[4. Username enumeration via subtly different responses]] - ✅ [[5. Username enumeration via response timing]] - ✅ [[6. Broken brute-force protection, IP block]] - ✅ [[7. Username enumeration via account lock]] - ✅ [[8. 2FA broken logic]] - ✅ [[9. Brute-forcing a stay-logged-in cookie]] - ✅ [[10. Offline Password Cracking]] - ✅ [[11. Password reset poisoning via middleware]] - ✅ [[12. Password brute-force via password change]] ## Expert Level - ✅ [[13. Broken brute-force protection, multiple credentials per request]] - ✅ [[14. 2FA bypass using a brute-force attack]]