I have found a Username Enumeration Vulnerability through which I am able to determine whether a particular user is registered with that site. While trying to brute force, after 5 attempts it asks for a CAPTCHA code. I have tried several methods to bypass the CAPTCHA but I'm not able to bypass it. So, now the situation is, I can find a particular username but cannot brute-force it. So,my question is, is this is considered a bug?

  • You can pick 5 passwords to try for each account you enumerate. Once you are required to enter a captcha, try a new account.
    – user11869
    Mar 24, 2014 at 19:23
  • Can this pose any other security risk to the company?? Mar 24, 2014 at 19:31
  • Oblig chapta vs automation post troyhunt.com/2012/01/…
    – CtrlDot
    Mar 24, 2014 at 19:34
  • @ctrldot i have asked something else.... Mar 24, 2014 at 19:39
  • You can still Brute-force this. Just throw in a modulo condition to connect to a different VPN/proxy after 5 attempts. But usually, having usernames isn't really exploitable unless there are other issues at work. Sep 19, 2016 at 15:12

3 Answers 3


Many security vulnerabilities are not by themselves exploitable. Often a combination of several vulnerabilities will result in an exploit. For example, if your application has a user enumeration vulnerability, this will allow an attacker who has stolen user credentials from another service to perform a more targeted (less easily foiled) attack against your authentication system. Next to that the vulnerability in itself is leaking information about your users (imagine you are running a consultation website for mental illnesses for example).

  • 2
    Additionally, having a list of known users aides in spearphishing attacks.
    – willc
    Sep 19, 2016 at 15:44
  • Spear phishing is a very good suggestion and it's easy to overlook it when assessing the consequences of user enumeration
    – Aurelio
    May 31, 2021 at 16:30

Yes this is a legitimate security issue, but less severe than most. Consider these circumstances:

  1. Any users with the top 5 most common passwords are toast. For example, Password1! from a lazy user may be the most likely password to meet this company's password strength requirements.

  2. Additional data could be associated with known usernames.

    For example, if my username is examplesmith, and you find [email protected], there's a good chance this is the same person.

    Additionally, you can search online and quite possibly find this person's Full Name, or even Cell Phone and Mailing Address.

    With additional information associated (advanced), you can send some rather convincing Phishing emails. At the very least you can include the username (simple) in the Phishing email to make it more convincing.

    Even unsuccessful Phishing attacks can reduce user confidence in the company's system.

So as you can see, knowing which Usernames are valid is not serious by itself, but can be helpful to perform other types of attacks on the system.

As @Marcel states, OWASP recognizes this as a legitimate issue.

Whether or not this particular issue is acceptable depends on the nature of this company's services. (i.e. ok for simple gaming sites, but never for online banking)

  • Also, if passwords used by this user on different sites are known from previous breaches, knowing with certainty that a users has an account on a target site helps the attacker.
    – M3RS
    Feb 23, 2021 at 6:57

This is a bug depending on how you define it. It is, per definition of OWASP, an Issue:

Testing for User Enumeration and Guessable User Account (OWASP-AT-002)

As a penetration tester, this is something you want to report.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .