Testing for User Enumeration and Guessable User Account (OWASP-AT-002)
This article is part of the OWASP Testing Guide v3. The entire OWASP Testing Guide v3 can be downloaded here.
OWASP at the moment is working at the OWASP Testing Guide v4: you can browse the Guide here
The scope of this test is to verify if it is possible to collect a set of valid usernames by interacting with the authentication mechanism of the application. This test will be useful for the brute force testing, in which we verify if, given a valid username, it is possible to find the corresponding password.
Often, web applications reveal when a username exists on system, either as a consequence of a misconfiguration or as a design decision. For example, sometimes, when we submit wrong credentials, we receive a message that states that either the username is present on the system or the provided password is wrong.
The information obtained can be used by an attacker to gain a list of users on system. This information can be used to attack the web application, for example, through a brute force or default username/password attack.
Description of the Issue
The tester should interact with the authentication mechanism of the application to understand if sending particular requests causes the application to answer in different manners. This issue exists because the information released from web application or web server, when we provide a valid username is different than when we use an invalid one.
In some cases, we can receive a message that reveals if the provided credentials are wrong because an invalid username or an invalid password was used. Sometimes, we can enumerate the existing users by sending a username and an empty password.
Black Box testing and example
In a black box testing, we know nothing about the specific application, username, application logic and error messages on login page, or password recovery facilities.
If the applications is vulnerable, we receive a response message that reveals, directly or indirectly, some information useful for enumerating users.
HTTP Response message
Testing for Valid user/right password
Record the server answer when you submit a valid userID and valid password.
Using WebScarab, notice the information retrieved from this successful authentication (HTTP 200 Response, length of the response).
Testing for valid user/wrong password
Now, the tester should try to insert a valid userID and a wrong password and record the error message generated by the application.
against any message that reveals the existence of user, for instance, message similar to:
Login for User foo: invalid password
Using WebScarab, notice the information retrieved from this unsuccessful authentication attempt (HTTP 200 Response, length of the response).
Testing for a nonexistent username
Now, the tester should try to insert an invalid userID and a wrong password and record the server answer (you should be confident that the username is not valid in the application). Record the error message and the server answer.
Login failed for User foo: invalid Account
Generally the application should respond with the same error message and length to the different wrong requests. If you notice that the responses are not the same, you should investigate and find out the key that creates a difference between the 2 responses. For example:
- Client request: Valid user/wrong password --> Server answer:'The password is not correct'
- Client request: Wrong user/wrong password --> Server answer:'User not recognized'
The above responses let the client understand that for the first request we have a valid user name. So we can interact with the application requesting a set of possible userIDs and observing the answer.
Looking at the second server response, we understand in the same way that we don't hold a valid username. So we can interact in the same manner and create a list of valid userID looking at the server answers.
Other ways to enumerate users
We can enumerate users in several ways, such as:
- Analyzing the error code received on login pages
Some web application release a specific error code or message that we can analyze.
- Analyzing URLs, and URLs redirections
As we can see above, when we provide a userID and password to the web application, we see a message indication that an error has occurred in the URL. In the first case we has provided a bad userID and bad password. In the second, a good user and bad password, so we can identify a valid userID.
- URI Probing
Sometimes a web server responds differently if it receives a request for an existing directories or not. For instance in some portals every user is associated with a directory, if we try to access an existing directory we could receive a web server error. A very common errors that we can receive from web server is:
403 Forbidden error code
404 Not found error code
http://www.foo.com/account1 - we receive from web server: 403 Forbidden http://www.foo.com/account2 - we receive from web server: 404 file Not Found
In first case the user exists, but we cannot view the web page, in second case instead the user “account2” doesn’t exist. Collecting this information we can enumerate the users.
- Analyzing Web page Title
We can receive useful information on Title of web page, where we can obtain a specific error code or messages that reveal if the problems are on username or password. For instance, if we cannot authenticate to an application and receive a web page whose title is similar to:
Invalid user Invalid authentication
- Analyzing message received from recovery facilities
When we use a recovery facilities the applications that is vulnerable could return a message that reveala if a username exists or not.
For example, message similar to the following:
Invalid username: e-mail address are not valid or The specified user was not found
Valid username: Your recovery password has been successfully sent
- Friendly 404 Error Message
When we request for a user within the directory that does not exist, we don't always receive 404 error code. Instead, we may receive “200 ok” with an image, in this case we can assume that when we receive the specific image the users doesn’t exist. This logic can be applied to other web server response; the trick is a good analysis of web server and web application messages.
In some cases the userIDs are created with specific policies of administrator or company. For example we can view a users with a userID created in sequential order:
Sometimes the username are created with a REALM alias and then a sequential numbers:
R1001 – user 001 for REALM1
R2001 – user 001 for REALM2
Other possibilities are userIDs associated with credit card numbers, or in general a numbers with a pattern. In the above sample we can create simple shell scripts that compose UserIDs and submit a request with tool like wget to automate a web query to discern valid userIDs. To create a script we can use also Perl and CURL.
Again, we can guess a username from the information received from an LDAP query or from a google information gathering for example from a specific domain. Google for example can help to find domain users through a specific queries or through a simple shell script or tool.
For other information on guessing for userIDs see next paragraph 4.5.3 Testing for Guessable (Dictionary) User Account.
Attention: by enumerating user accounts, you risk to lock out accounts after a predefined number of failed probes (based on application policy). Also, sometimes, our IP address can be banned by dynamic rules on the application firewall.
Gray Box testing and example
Testing for Authentication error messages
Verify that the application answers in the same manner for every client request that produces a failed authentication. For this issue the Black Box testing and Gray Box testing are the same concept based on the analysis of messages or error codes received from web application.
The application should answer in the same manner for every failed attempt of authentication.
Credentials submitted are not valid