Authentication Enumerations#

  • Identifying valid usernames: observe response of login or password resets.
  • Password policies: info when we enter password that does not match the policies, is used gauge the potential complexity of passwords and tailor strategy.
  • Common places to enerumerate:
    #registration pages, Fails if username already used. So, we can list of valid users.
#Password reset features: Fails if username does not belong to valid account. Can list the valid usernames.
#Verbose Errors: these intential errors can provide us the info about whether valid user, valid pass??
# Data Breach info: data from previous breaches is goldmine, allows us to find whether compromised credentials are reused across the platforms.

Enumerating Users via Verbose errors#

  • Verbose errors can turn into a goldmine of information, providing insights such as: Internal Paths, Database details like spilling secrets, User information etc
  • Inducing verbose errors: forcing application to reveal its secrets by using belwo techniques.
     Invalid login attempts
 SQL injections
 File Inclusion/Path Traversal
 FOrm Manupulation
 Application Fuzzing
  • Role of enumeration and brute forcing: User Enumerations, Exploiting versbose errors.
    cd sources/
git clone git@github.com:nyxgeek/username-lists.git
python3 email_bruteforce.py "username-lists/usernames-top100/usernames_gmail.com.txt"

Exploiting Vulnerable Password Reset Logic#

Password Reset Flow Vulnerabilities#

  • Email-Based Reset
  • Security Question-Based Reset
  • SMS-Based Reset

OSINT#

  • Wayback urls
  • Think of the Internet Archive’s Wayback Machine (https://archive.org/web/) as a time machine
  • To dump all of the links that are saved in Wayback Machine, we can use the tool called waybackurls.
  • git clone https://github.com/tomnomnom/waybackurls
  • cd waybackurls
  • sudo apt install golang-go -y
  • ls -la
  • ./waybackurls tryhackme.com