the-web-application-hackers-handbook

Chapter 6 n Attacking Authentication 183
HACK STEPS
1. If the application generates usernames, try to obtain several in quick
succession, and determine whether any sequence or pattern can be
discerned.
2. If it can, extrapolate backwards to obtain a list of possible valid usernames.
This can be used as the basis for a brute-force attack against the
login and other attacks where valid usernames are required, such as the
exploitation of access control flaws (see Chapter 8).
TRY IT!
http://mdsec.net/auth/169/
Predictable Initial Passwords
In some applications, users are created all at once or in sizeable batches and are
automatically assigned initial passwords, which are then distributed to them
through some means. The means of generating passwords may enable an attacker
to predict the passwords of other application users. This kind of vulnerability is
more common on intranet-based corporate applications — for example, where
every employee has an account created on her behalf and receives a printed
notification of her password.
In the most vulnerable cases, all users receive the same password, or one
closely derived from their username or job function. In other cases, generated
passwords may contain sequences that could be identified or guessed with
access to a very small sample of initial passwords.
HACK STEPS
1. If the application generates passwords, try to obtain several in quick
succession, and determine whether any sequence or pattern can be
discerned.
2. If it can, extrapolate the pattern to obtain a list of passwords for other
application users.
3. If passwords demonstrate a pattern that can be correlated with usernames,
you can try to log in using known or guessed usernames and the
corresponding inferred passwords.
4. Otherwise, you can use the list of inferred passwords as the basis for a
brute-force attack with a list of enumerated or common usernames.