The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Many authentication mechanisms disclose usernames either implicitly

or explicitly. In a web mail account, the username is often the email address,

which is common knowledge by design. Many other sites expose usernames

within the application without considering the advantage this grants to an

attacker, or allow usernames to be easily guessed (for example, user1842).

Chapter 6 

■

Attacking Authentication

139

70779c06.qxd:WileyRed  9/14/07  3:13 PM  Page 139

---

In more complex login mechanisms, where an application requires the user

to submit several pieces of information, or proceed through several stages,

verbose failure messages or other discriminators can enable an attacker to tar-

get each stage of the login process in turn, increasing the likelihood that they

will gain unauthorized access.

N OT E