User Enumeration

What is user enumeration?

• A process of identifying valid phone numbers

• A process of identifying valid email addresses

• A process of identifying valid passwords

• A process of identifying valid usernames

What is one danger of username enumeration?

• Social media hacking

• Phishing attacks

• Credential stuffing

• Brute forcing email addresses

How can an attacker use a list of valid usernames?

• To identify social security numbers

• To identify phone numbers

• To identify valid email addresses

• To identify common passwords

What should be the response when a login failure occurs?

• Return a generic 'No such username or password' message

• Return the specific reason for the login failure

• Return a generic 'Invalid username' message

• Reveal the username in the error message

What is a recommended security measure to prevent username enumeration?

• Implementing multifactor authentication (MFA)

• Returning specific error messages for login failures

• Revealing usernames on the forgotten password page

• Not using a web application firewall (WAF)

What is a potential risk associated with username enumeration?

• Identity theft

• Phishing attacks

• Credential stuffing

• Brute forcing email addresses