I am responsible for a website that allows a user to reset the password, as usual. However, the response of the website is different whether the entered username matches or not.
This would allow an attacker to derive a dictionary of usernames in use.
Is this considered a risk? How much?
- The website logs each request, so after a while, repeated requests will pile up, but there are no other measures currently.
- I will soon fix that problem by returning the same response content, but would like to use this behaviour as an exercise to me and learn about security. I could imagine, that, by response-time-measurements, the fix will still allow to at least guess usernames.
- Before fixing, I would like to see how bad or not this specific problem is. After the fix, I would like to rerun any previously successful test to assert, that the problem really is gone.
Using the ZAP Proxy and sqlmap (with aggressive levels), I was not able to find an automated exploit/test to this problem.