The whole point of
this phase is to see if can retrieve valid usernames. The usernames can help
improve the effectiveness of other security attacks (bruteforcing, social
engineering, etc…). Web applications tend to reveal existing usernames in
different ways. For example, if I try to register and type 'martin' as the
username, the application might sent out an error that states that the username
already exists. If an attacker does this for a while, he or she can have a long
list of valid usernames. Another way to
retrieve usernames is by trying to login to the system. If I try the username
"martin", and a random password - the application might print out an
error saying "Sorry, you entered the wrong password". This pretty
much tells us the username is completely valid. Lastly, some other ways of
looking for valid usernames includes :
- Analyzing Page titles - Invalid User and Invalid Authentication could mean two different issues.
- Analyzing Message for credential recovery facilities - basically, using the "forgot password" or "forgot username" parts of a website to figure out which usernames are valid or not.
- Guessing usernames - Sometimes, usernames are in sequential order (ex, LabUser1, LabUser2).
