> For the complete documentation index, see [llms.txt](https://0xb0b.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xb0b.gitbook.io/writeups/hack-smarter-labs/2025/hunter.md). # Hunter {% embed url="" %} The following post by 0xb0b is licensed under [CC BY 4.0

](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1) *** ## Scenario ## Objective / Scope You are an operator for the **Hack Smarter Red Team**, currently conducting a black-box assessment on a client's external login portal. As part of the initial reconnaissance phase, our OSINT analysts have compiled a list of potential usernames. You need to identify which one is a valid username for the web application. ## Recon We use rustscan `-b 500 -a 10.1.216.45 -- -sC -sV -Pn` to enumerate all TCP ports on the target machine, piping the discovered results into Nmap which runs default NSE scripts `-sC`, service and version detection `-sV`, and treats the host as online without ICMP echo `-Pn`. A batch size of `500` trades speed for stability, the default `1500` balances both, while much larger sizes increase throughput but risk missed responses and instability. ``` rustscan -b 500 -a 10.1.216.45 -- -sC -sV -Pn ```

Like in the scope defined our target has a web server running on port `80`.

Next, we run a Feroxbuster scan and detect a `login` and `reset` page. {% code overflow="wrap" %} ``` feroxbuster -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -u 'http://10.1.216.45' ``` {% endcode %}

We visit the `login` page and try to use arbitrary credentials, but we do not receive any response of success or failure to enumerate any users here. ``` http://10.1.216.45/login ```

We capture a `login` request using BurpSuite to identify the request made for later use in FFuF.

Next, we move on to the `reset` password page. ``` http://10.1.216.45/reset ```

Here too, we do not receive any response to enumerate a valid user.

We capture a `reset` request using BurpSuite to identify the request made for later use in FFuF.

## Username Enumeration Maybe we have missed something, and the response might differ with a valid user, but a wrong password. We try to log in with the usernames provided from the scenario and filter by the response size, but without success. {% code overflow="wrap" %} ``` ffuf -w usernames.txt -u http://10.1.216.45/login -X POST -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=FUZZ&passowrd=asdf' -fw 453 ``` {% endcode %}

We repeat that for the reset page, but again without success. {% code overflow="wrap" %} ``` ffuf -w usernames.txt -u http://10.1.216.45/reset -X POST -H 'Content-Type: application/x-www-form-urlencoded' -H 'username:FUZZ' -fw 468 ``` {% endcode %}

So what could we have overlooked? Well, when a reset is performed, it is possible that additional functions are triggered for a valid user, such as sending an email, which could lead to a delay. So we could inspect the duration the request required. With 301 usernames we could find it already in this reset attempts made using FFuF. {% code overflow="wrap" %} ``` ffuf -w usernames.txt -u http://10.1.216.45/reset -X POST -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=FUZZ' ``` {% endcode %}

We filter for request that take longer than the usual 100 - 200ms. In this case more than 500ms and are. able to spot one request that took 1000ms for the valid user. {% code overflow="wrap" %} ``` ffuf -w usernames.txt -u http://10.1.216.45/reset -X POST -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=FUZZ' -ft '<500' ``` {% endcode %}

## Further Reading A comprehensive guide on user enumeration on web applications can be found here: {% embed url="" %}