the-web-application-hackers-handbook

166 Chapter 6 n Attacking Authentication
Verbose Failure Messages
A typical login form requires the user to enter two pieces of information — a
username and password. Some applications require several more, such as date
of birth, a memorable place, or a PIN.
When a login attempt fails, you can of course infer that at least one piece of
information was incorrect. However, if the application tells you which piece of
information was invalid, you can exploit this behavior to considerably diminish
the effectiveness of the login mechanism.
In the simplest case, where a login requires a username and password, an
application might respond to a failed login attempt by indicating whether the
reason for the failure was an unrecognized username or the wrong password,
as illustrated in Figure 6-3.
Figure 6-3: Verbose login failure messages indicating when a valid
username has been guessed
In this instance, you can use an automated attack to iterate through a large
list of common usernames to enumerate which ones are valid. Of course, usernames
normally are not considered a secret (they are not masked during login,
for instance). However, providing an easy means for an attacker to identify valid
usernames increases the likelihood that he will compromise the application
given enough time, skill, and effort. A list of enumerated usernames can be
used as the basis for various subsequent attacks, including password guessing,
attacks on user data or sessions, or social engineering.
In addition to the primary login function, username enumeration can arise
in other components of the authentication mechanism. In principle, any function
where an actual or potential username is submitted can be leveraged for
this purpose. One location where username enumeration is commonly found
is the user registration function. If the application allows new users to register
and specify their own usernames, username enumeration is virtually impossible
to prevent if the application is to prevent duplicate usernames from being
registered. Other locations where username enumeration are sometimes found