Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have found a Username Enumeration Vulnerability through which I am able to determine whether a particular user is registered with that site. While trying to brute force, after 5 attempts it asks for a CAPTCHA code. I have tried several methods to bypass the CAPTCHA but I'm not able to bypass it. So, now the situation is, I can find a particular username but cannot brute-force it. So,my question is, is this is considered a bug?

share|improve this question
You can pick 5 passwords to try for each account you enumerate. Once you are required to enter a captcha, try a new account. – Rell3oT Mar 24 '14 at 19:23
Can this pose any other security risk to the company?? – justtrying123 Mar 24 '14 at 19:31
Oblig chapta vs automation post… – CtrlDot Mar 24 '14 at 19:34
@ctrldot i have asked something else.... – justtrying123 Mar 24 '14 at 19:39
up vote 2 down vote accepted

Many security vulnerabilities are not by themselves exploitable. Often a combination of several vulnerabilities will result in an exploit. For example, if your application has a user enumeration vulnerability, this will allow an attacker who has stolen user credentials from another service to perform a more targeted (less easily foiled) attack against your authentication system. Next to that the vulnerability in itself is leaking information about your users (imagine you are running a consultation website for mental illnesses for example).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.