the-web-application-hackers-handbook

Chapter 21 n A Web Application Hacker’s Methodology 809
other users, particularly administrative users, which may enable you
escalate privileges.
4.7.3 If you perform any automated password-guessing attacks against other
user accounts, look for any accounts that appear to have more than one
valid password, or multiple accounts that appear to have the same password.
This may indicate the presence of a backdoor password, which
administrators can use to access the application as any user.
4.8 Test Username Uniqueness
4.8.1 If the application has a self-registration function that lets you specify
a desired username, attempt to register the same username twice with
different passwords.
4.8.2 If the application blocks the second registration attempt, you can exploit
this behavior to enumerate registered usernames.
4.8.3 If the application registers both accounts, probe further to determine its
behavior when a collision of username and password occurs. Attempt
to change the password of one of the accounts to match that of the
other. Also, attempt to register two accounts with identical usernames
and passwords.
4.8.4 If the application alerts you or generates an error when a collision of
username and password occurs, you can probably exploit this to perform
an automated guessing attack to discover another user’s password. Target
an enumerated or guessed username, and attempt to create accounts
that have this username and different passwords. When the application
rejects a specific password, you have probably found the existing
password for the targeted account.
4.8.5 If the application appears to tolerate a collision of username and password
without an error, log in using the colliding credentials. Determine
what happens and whether the application’s behavior can be leveraged
to gain unauthorized access to other users’ accounts.
4.9 Test Predictability of Autogenerated Credentials
4.9.1 If the application automatically generates usernames or passwords, try
to obtain several values in quick succession and identify any detectable
sequences or patterns.
4.9.2 If usernames are generated in a predictable way, extrapolate backwards
to obtain a list of possible valid usernames. You can use this as the basis
for automated password-guessing and other attacks.