The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

This vulnerability may arise in more subtle ways than illustrated 

here. Even if the error messages returned in response to a valid and invalid

username are superficially similar, there may be small differences between

them that can be used to enumerate valid usernames. For example, if multiple

code paths within the application return the “same” failure message, there may

be minor typographical differences between each instance of the message. In

some cases, the application’s responses may be identical on-screen but contain

subtle differences hidden within the HTML source, such as comments or layout

differences. If no obvious means of enumerating usernames presents itself, you

should perform a very close comparison of the application’s responses to valid

and invalid usernames.

HACK STEPS

■