the-web-application-hackers-handbook

Chapter 6 n Attacking Authentication 167
are the password change and forgotten password functions, as described later
in this chapter.
NOTE Many authentication mechanisms disclose usernames either implicitly
or explicitly. In a web mail account, the username is often the e-mail
address, which is common knowledge by design. Many other sites expose
usernames within the application without considering the advantage this
grants to an attacker, or generate usernames in a way that can be predicted
(for example, user1842, user1843, and so on).
In more complex login mechanisms, where an application requires the user to
submit several pieces of information, or proceed through several stages, verbose
failure messages or other discriminators can enable an attacker to target each
stage of the login process in turn, increasing the likelihood that he will gain
unauthorized access.
NOTE This vulnerability may arise in more subtle ways than illustrated here.
Even if the error messages returned in response to a valid and invalid username
are superficially similar, there may be small differences between them that can
be used to enumerate valid usernames. For example, if multiple code paths
within the application return the “same” failure message, there may be minor
typographical differences between each instance of the message. In some cases,
the application’s responses may be identical on-screen but contain subtle differences
hidden within the HTML source, such as comments or layout differences. If
no obvious means of enumerating usernames presents itself, you should perform
a close comparison of the application’s responses to valid and invalid usernames.
You can use the Comparer tool within Burp Suite to automatically analyze
and highlight the differences between two application responses, as shown
in Figure 6-4. This helps you quickly identify whether the username’s validity
results in any systematic difference in the application’s responses.
Figure 6-4: Identifying subtle differences in application responses using Burp Comparer