Broken Authentication -> Username Enumeration
Username enumeration is a technique of guessing a valid usernames on a server or web application.
Exploitation
In this test, we are going to use two usernames with invalid passwords, one is already registered username admin and the other is unregistered username anything. We will try to distinguish registered username from unregistered by examining the error message.
Let’s test for registered user admin with invalid password
We got an error message saying password incorrect, this looks like the username is correct. But let’s test for the unregistered username to see if we can get different error message. We will enter exploit as the username.
As you can see, this time we got different error message saying account does not exist. This differences in the error messages will allow attacker to distinguish registered usernames from the others.