the-web-application-hackers-handbook

Chapter 21 n A Web Application Hacker’s Methodology 807
4.3.4 Check for any other sources of information leakage within the application
that may enable you to compile a list of valid usernames. Examples
are logging functionality, actual listings of registered users, and direct
mention of names or e-mail addresses in source code comments.
4.3.5 Locate any subsidiary authentication that accepts a username, and
determine whether it can be used for username enumeration. Pay
specific attention to a registration page that allows specification of a
username.
4.4 Test Resilience to Password Guessing
4.4.1 Identify every location within the application where user credentials
are submitted. The two main instances typically are the main login
function and the password change function. The latter normally is a
valid target for password-guessing attacks only if an arbitrary username
can be supplied.
4.4.2 At each location, using an account that you control, manually send
several requests containing the valid username but other invalid
credentials. Monitor the application’s responses to identify any differences.
After about 10 failed logins, if the application has not returned
a message about account lockout, submit a request containing valid
credentials. If this request succeeds, an account lockout policy probably
is not in force.
4.4.3 If you do not control any accounts, attempt to enumerate or guess a
valid username, and make several invalid requests using this guess,
monitoring for any error messages about account lockout. Of course,
you should be aware that this test may have the effect of suspending or
disabling an account belonging to another user.
4.5 Test Any Account Recovery Function
4.5.1 Identify whether the application contains any facility for users to regain
control of their account if they have forgotten their credentials. This
is often indicated by a Forgot Your Password link near the main login
function.
4.5.2 Establish how the account recovery function works by doing a complete
walk-through of the recovery process using an account you control.
4.5.3 If the function uses a challenge such as a secret question, determine
whether users can set or select their own challenge during registration.
If so, use a list of enumerated or common usernames to harvest a list of
challenges, and review this for any that appear to be easily guessable.