The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

change, and forgotten password). 

■

If a difference is detected in the server’s responses to valid and invalid

usernames, obtain a list of common usernames and use a custom script

or automated tool to quickly submit each username and filter the

responses that signify that the username is valid (see Chapter 13).

(continued)

140

Chapter 6 

■

Attacking Authentication

70779c06.qxd:WileyRed  9/14/07  3:13 PM  Page 140

---

HACK STEPS (continued)

■

Before commencing your enumeration exercise, verify whether the appli-

cation performs any account lockout after a certain number of failed

login attempts (see the “Brute-Forcible Login” section). If so, it is desir-