Authentication Testing - Default or Guessable (dictionary) user account

Nowadays, web applications used are open source and/or extremely popular and relatively well known.  They also require some type of minimal configuration by the user to be properly setup. Unfortunately, plenty of people misconfigure their web apps leading to certain security issues. For example, certain web applications come with a default username and password. Part of the configuration process is to delete this username and password and create another administrator account.  People don't like doing this and thus a lot of web applications exists with default usernames and password ready for some attacker to completely take control of it.

Some common usernames and passwords are listed below:

• Usernames
• Admin, administrator, root, system, guest, operator, super, qa, test, test1, testing.

• Passwords
• <completely blank password>, password, pass123, password123, admin, guest.

Some times, usernames are named after the application it self. So if we are trying to penetrate an application called "SystemKeeper"  - one should try systemkeeper as a username and perhaps also the password.  Another way to do find a password is looking at the source. Poorly programmed applications might have the username  visible in the source.

CIRT, GovermentSecurity.org, and virus.org provides the default usernames and password for various applications and devices.

Authentication Testing - Testing for Enumeration

The whole point of this phase is to see if can retrieve valid usernames. The usernames can help improve the effectiveness of other security attacks (bruteforcing, social engineering, etc…). Web applications tend to reveal existing usernames in different ways. For example, if I try to register and type 'martin' as the username, the application might sent out an error that states that the username already exists. If an attacker does this for a while, he or she can have a long list of valid usernames.  Another way to retrieve usernames is by trying to login to the system. If I try the username "martin", and a random password - the application might print out an error saying "Sorry, you entered the wrong password". This pretty much tells us the username is completely valid. Lastly, some other ways of looking for valid usernames includes :

• Analyzing Page titles - Invalid User and Invalid Authentication could mean two different issues.

• Analyzing Message for credential recovery facilities - basically, using the "forgot password" or "forgot username" parts of a website to figure out which usernames are valid or not.

• Guessing usernames - Sometimes, usernames are in sequential order (ex, LabUser1, LabUser2).