I have found a Username Enumeration Vulnerability through which I am able to determine whether a particular user is registered with that site. While trying to brute force, after 5 attempts it asks for a CAPTCHA code. I have tried several methods to bypass the CAPTCHA but I'm not able to bypass it. So, now the situation is, I can find a particular username but cannot brute-force it. So,my question is, is this is considered a bug?
-
You can pick 5 passwords to try for each account you enumerate. Once you are required to enter a captcha, try a new account.– user11869Mar 24, 2014 at 19:23
-
Can this pose any other security risk to the company??– justtrying123Mar 24, 2014 at 19:31
-
Oblig chapta vs automation post troyhunt.com/2012/01/…– CtrlDotMar 24, 2014 at 19:34
-
@ctrldot i have asked something else....– justtrying123Mar 24, 2014 at 19:39
-
You can still Brute-force this. Just throw in a modulo condition to connect to a different VPN/proxy after 5 attempts. But usually, having usernames isn't really exploitable unless there are other issues at work.– Mark BuffaloSep 19, 2016 at 15:12
Add a comment
|
3 Answers
Many security vulnerabilities are not by themselves exploitable. Often a combination of several vulnerabilities will result in an exploit. For example, if your application has a user enumeration vulnerability, this will allow an attacker who has stolen user credentials from another service to perform a more targeted (less easily foiled) attack against your authentication system. Next to that the vulnerability in itself is leaking information about your users (imagine you are running a consultation website for mental illnesses for example).
Yes this is a legitimate security issue, but less severe than most. Consider these circumstances:
Any users with the top 5 most common passwords are toast. For example,
Password1!from a lazy user may be the most likely password to meet this company's password strength requirements.Additional data could be associated with known usernames.
For example, if my username is
examplesmith, and you find[email protected], there's a good chance this is the same person.Additionally, you can search online and quite possibly find this person's Full Name, or even Cell Phone and Mailing Address.
With additional information associated (advanced), you can send some rather convincing Phishing emails. At the very least you can include the username (simple) in the Phishing email to make it more convincing.
Even unsuccessful Phishing attacks can reduce user confidence in the company's system.
So as you can see, knowing which Usernames are valid is not serious by itself, but can be helpful to perform other types of attacks on the system.
As @Marcel states, OWASP recognizes this as a legitimate issue.
Whether or not this particular issue is acceptable depends on the nature of this company's services. (i.e. ok for simple gaming sites, but never for online banking)
answered Sep 19, 2016 at 14:53
-
Also, if passwords used by this user on different sites are known from previous breaches, knowing with certainty that a users has an account on a target site helps the attacker.– M3RSFeb 23, 2021 at 6:57
This is a bug depending on how you define it. It is, per definition of OWASP, an Issue:
Testing for User Enumeration and Guessable User Account (OWASP-AT-002)
As a penetration tester, this is something you want to report.
