I have found a Username Enumeration Vulnerability through which I am able to determine whether a particular user is registered with that site. While trying to brute force, after 5 attempts it asks for a CAPTCHA code. I have tried several methods to bypass the CAPTCHA but I'm not able to bypass it. So, now the situation is, I can find a particular username but cannot brute-force it. So,my question is, is this is considered a bug?

  • You can pick 5 passwords to try for each account you enumerate. Once you are required to enter a captcha, try a new account. – user11869 Mar 24 '14 at 19:23
  • Can this pose any other security risk to the company?? – justtrying123 Mar 24 '14 at 19:31
  • Oblig chapta vs automation post troyhunt.com/2012/01/… – CtrlDot Mar 24 '14 at 19:34
  • @ctrldot i have asked something else.... – justtrying123 Mar 24 '14 at 19:39
  • You can still Brute-force this. Just throw in a modulo condition to connect to a different VPN/proxy after 5 attempts. But usually, having usernames isn't really exploitable unless there are other issues at work. – Mark Buffalo Sep 19 '16 at 15:12

Many security vulnerabilities are not by themselves exploitable. Often a combination of several vulnerabilities will result in an exploit. For example, if your application has a user enumeration vulnerability, this will allow an attacker who has stolen user credentials from another service to perform a more targeted (less easily foiled) attack against your authentication system. Next to that the vulnerability in itself is leaking information about your users (imagine you are running a consultation website for mental illnesses for example).

  • 1
    Additionally, having a list of known users aides in spearphishing attacks. – willc Sep 19 '16 at 15:44

Yes this is a legitimate security issue, but less severe than most. Consider these circumstances:

  1. Any users with the top 5 most common passwords are toast. For example, Password1! from a lazy user may be the most likely password to meet this company's password strength requirements.

  2. Additional data could be associated with known usernames.

    For example, if my username is examplesmith, and you find examplesmith@gmail.com, there's a good chance this is the same person.

    Additionally, you can search online and quite possibly find this person's Full Name, or even Cell Phone and Mailing Address.

    With additional information associated (advanced), you can send some rather convincing Phishing emails. At the very least you can include the username (simple) in the Phishing email to make it more convincing.

    Even unsuccessful Phishing attacks can reduce user confidence in the company's system.

So as you can see, knowing which Usernames are valid is not serious by itself, but can be helpful to perform other types of attacks on the system.

As @Marcel states, OWASP recognizes this as a legitimate issue.

Whether or not this particular issue is acceptable depends on the nature of this company's services. (i.e. ok for simple gaming sites, but never for online banking)

  • Also, if passwords used by this user on different sites are known from previous breaches, knowing with certainty that a users has an account on a target site helps the attacker. – M3RS Feb 23 at 6:57

This is a bug depending on how you define it. It is, per definition of OWASP, an Issue:

Testing for User Enumeration and Guessable User Account (OWASP-AT-002)

As a penetration tester, this is something you want to report.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.