Lab: under the lockout radar
Per-username lockouts stop hammering. Spray common passwords instead.
Read the login logic and its lockout rule. Hammer one account to watch the lockout trigger, then change strategy: one common password across accounts never trips a per-username counter. The reset flow has its own lesson — issue a token and read its terms.
That was the whole lesson.
A free account adds the interactive part: the marking quiz, the lab if this lesson carries one, live progress, the timed exam, and a certificate employers can verify.