Description

User enumeration is when a malicious actor can use brute-force techniques to either guess or confirm valid users in a system. The malicious actor is looking for differences in the server's response based on the validity of submitted credentials. The differences can be inside the response body, response headers or sometimes, in the response delay.

Proof of Concept

1. Go to /password/reset
2. Enter the following two emails and check the difference of the responses:

• Registered email:

<input id="email" type="email" class="form-control" name="email" placeholder="E-Mail Address" value="" required>

• Not registered email:

<input id="email" type="email" class="form-control" name="email" placeholder="E-Mail Address" value="xxx@local" required>

Notice that not registered email is in the value attribute.

Impact

User and email enumeration allows an attacker to find valid usernames/emails on the victim application. It can use this information to do more advanced attacks like bruteforcing passwords or phishing attemps.