The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

able to design your enumeration attack with this fact in mind. For exam-

ple, if the application will grant you only three failed login attempts with

any given account, you run the risk of “wasting” one of these for every

username that you discover through automated enumeration. Therefore,

when performing your enumeration attack, do not submit a completely

far-fetched password with each login attempt, but rather submit either

(a) a single common password such as “password1” or (b) the username

itself as the password. If password quality rules are weak, it is highly

likely that some of the attempted logins that you perform as part of your

enumeration exercise will actually be successful and disclose both the

username and password in one single hit. To implement option (b) and