Testing for User Enumeration and Guessable User Account (OWASP-AT-002)
Details of BNVL-2018-0016
What does the BNVL label mean?
BitNinja Server Security’s BNVL identifiers are intended for use to identify publicly known information security vulnerabilities in publicly released software packages. This project was designed to collect and analyze attack information from the BitNinja network after cluster analysis by the AI-powered Attack Vector Miner. More than 100 vulnerability types have been discovered with this project so far, so we decided to publish this platform to help to keep Linux server owners up-to-date.
Syntax for BNVL labels:
BNVL prefix + Year + Arbitrary Digits
Name : Testing for User Enumeration and Guessable User Account (OWASP-AT-002)
Related Links: https://www.owasp.org/index.php/Testing_for_User_Enumeration_and_Guessable_User_Account_(OWASP-AT-002)
CVE ID: Na
The scope of this test is to verify if it is possible to collect a set of valid usernames by interacting with the authentication mechanism of the application. This test will be useful for the brute force testing, in which we verify if, given a valid username, it is possible to find the corresponding password. Often, web applications reveal when a username exists on system, either as a consequence of a misconfiguration or as a design decision. For example, sometimes, when we submit wrong credentials, we receive a message that states that either the username is present on the system or the provided password is wrong. The information obtained can be used by an attacker to gain a list of users on system. This information can be used to attack the web application, for example, through a brute force or default username/password attack.