Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have found a Username Enumeration Vulnerability through which I am able to determine whether a particular user is registered with that site. While trying to brute force, after 5 attempts it asks for a CAPTCHA code. I have tried several methods to bypass the CAPTCHA but I'm not able to bypass it. So, now the situation is, I can find a particular username but cannot brute-force it. So,my question is, is this is considered a bug?

share|improve this question
    
You can pick 5 passwords to try for each account you enumerate. Once you are required to enter a captcha, try a new account. –  Rell3oT Mar 24 at 19:23
    
Can this pose any other security risk to the company?? –  exploitprotocol Mar 24 at 19:31
    
Oblig chapta vs automation post troyhunt.com/2012/01/… –  CtrlDot Mar 24 at 19:34
    
@ctrldot i have asked something else.... –  exploitprotocol Mar 24 at 19:39

1 Answer 1

up vote 1 down vote accepted

Many security vulnerabilities are not by themselves exploitable. Often a combination of several vulnerabilities will result in an exploit. For example, if your application has a user enumeration vulnerability, this will allow an attacker who has stolen user credentials from another service to perform a more targeted (less easily foiled) attack against your authentication system. Next to that the vulnerability in itself is leaking information about your users (imagine you are running a consultation website for mental illnesses for example).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.