Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [user-enumeration]

A technique used on systems that leak information on whether a given user exists or not, to get a list of registered users.

4
votes
2answers
158 views

Dealing with violating privacy of registered users during failed authentication

We are forth and back discussing how to deal with privacy issues during failed authentication, password reset and account creation on a web application. Let's say I am in the process of creating an ...
0
votes
2answers
161 views

Is the common recommendation to obscure the existance of a username on login just security theater? [duplicate]

It is a common recommendation to return "Username or password is incorrect" instead of "Username does not exist" when the given username does not exist and "Password is incorrect" when username exists ...
0
votes
0answers
111 views

How would the identity of a company be discovered through banner ads?

Our company has started researching using a new tech. We started seeing banner ads for a consulting company "with expertise in" this new tech. The recently we had a call from someone representing ...
1
vote
2answers
151 views

How to secure email validation endpoint?

We have email validation in our registration form (an Ajax call to a REST endpoint to validate an email address when a user enters it). Lets say a normal form first name, Last name, Email, Password, ...
61
votes
7answers
13k views

Is it unsafe to show message that username/account does not exist at login? [duplicate]

According to the OWASP Auth Guidelines, "An application should respond with a generic error message regardless of whether the user ID or password was incorrect. It should also give no indication to ...
0
votes
1answer
587 views

PSExec not working against windows XP (metasploit)

I am following the book Penetration Testing: A Hands-On Introduction to Hacking from Georgia Weidman. In Ch 13, page 296 the psexec from metasploit is used against a Windows XP Profession SP3 (32-bit),...
3
votes
3answers
169 views

What attacks are possible if you can scrape a list of users?

Have there been any attacks (or can you think of a potential attack) that hinged on being able to figure out if a user exists in a system? For example, in a web app there is a "Reset password" page ...
3
votes
1answer
436 views

Windows registry keys not preventing users/group enumeration via null session

While testing our Windows Domain Controller (Server 2012 R2), I was able use the Linux utility rpcclient to enumerate user accounts and groups via a Null Session (see output below). Checking the ...
1
vote
1answer
777 views

Should I be concerned about the WordPress REST API's user enumeration vulnerability?

With the current WordPress API you can get a list of usernames and email addresses of all users in the system with almost no effort: <url>/wp-json/wp/v2/users Outputs something like: [{ "...
0
votes
1answer
4k views

How did hackers brute force my Windows server username?

About a year ago my Windows server 2008 R2 server was hacked. I had RDP open to the world, I know, not a good idea. Being that it was a year ago I don't have any of the logs, but I was thinking about ...
0
votes
1answer
116 views

User account existence confirmation [duplicate]

It used to be the case that authentication systems wouldn't confirm whether a user account existed and, instead, would simply report that the user logon name or password was incorrect. Nowadays, a ...
2
votes
2answers
210 views

Is it vulnerable to let users know their own and other users id from a database?

Say, I have a table Users with the id being an integer. Each user somehow is aware of their id somehow, for example, in an url to their profile the id is included. Or it's exposed to them by some ...
2
votes
1answer
328 views

How to effectively test for username enumeration risk?

I am responsible for some public-facing web applications, and I want to test these for the username enumeration risk as explained in Testing for User Enumeration and Guessable User Account (OWASP-AT-...
3
votes
1answer
333 views

Why do several bug bounties ignore user enumeration?

While viewing bug bounties, I noticed that most of the bug bounties list the user enumeration in the excluding list. For instance brute forcing user accounts, forget password forms would generally ...
69
votes
3answers
12k views

Does correcting misspelled usernames create a security risk?

Does correcting a misspelled username and prompting the user with a valid username introduce a security risk? I recently tried logging into facebook and misspelled my email. They prompted me with ...
4
votes
1answer
1k views

Informative error messages in password reset functionality?

When I am implementing password reset functionality I usually do not include informative messages about whether a user was found, because I have always believed that it can lead to user name ...
4
votes
1answer
150 views

Does providing non existant users with fake salts prevent user enumeration?

Background I'm currently setting up a basic username & hash based login process for a web application. The process consist of the following steps: User submits their username. Server responds ...
15
votes
7answers
2k views

Mitigate timing attack threat against password recovery page

We recently had an external security review performed on a public-facing website we manage. They noted that on the "recover password page", there are different response times when providing existing ...
7
votes
6answers
885 views

Forgot password and revealing whether account exists [duplicate]

So when you hit that forgot password link and enter your email address, it seems that sites (and other programmers I've spoken to) are one of either two mindsets; Notify the user whether or not the ...
1
vote
0answers
130 views

Low-resolution account enumeration with Office365

I am interested in the intersection of account enumeration and single sign-on. Often, there will be SSO-only and non-SSO users alongside each other in an application, and in terms of improved ...
83
votes
10answers
15k views

New Gmail login system—going against conventional wisdom?

I noticed that the new gmail login asks for username first, and then confirms if such username exists, before asking for password input. Does this not go against conventional security wisdom to not ...
1
vote
2answers
388 views

Having a consistent “don't reveal email addresses of members” policy [duplicate]

Developers are dogmatic on having "invalid username or password" on login screens; our applications should not reveal if somebody is a member given an email address. But there are two other ways our ...
10
votes
5answers
5k views

Preventing User Enumeration on Registration Page

You have a website that users log into, and you want to prevent user enumeration. On the login page and the forgotten password page, this can be achieved by careful choice of user messages, but what ...
10
votes
2answers
2k views

User Enumeration Vulnerability while creating Google account

When we create a Google account, Google tells us whether an account with specified username exists or not. Doesn't that lead to user enumeration? Why not let users fill other information first, ...
71
votes
9answers
33k views

Generic error message for wrong password or username - is this really helpful?

It is really common (and I would say it is some kind of security basic) to not show on the login page if the username or the password was wrong when a user tries to log in. One should show a generic ...
13
votes
4answers
10k views

User name enumeration?

From what I understand it is bad security practice to display informative failed login messages like: The email you entered does not exist Instead of Incorrect email/password combination ...
51
votes
4answers
11k views

Disclose to user if account exists?

Someone told me it shouldn't be possible for someone to detect if a certain email address is used by a registered user on a website. So, for instance, when the user asks to reset his password, you ...
5
votes
1answer
342 views

CAPTCHA enough to thwart user enumeration?

Say I have a site that has a user registration process where, when a user enters an email address already in use, an error message is displayed telling them that. This seems like a easy way to a ...