Hunter
Challenge Lab (Easy) - by Tyler Ramsbey
The following post by 0xb0b is licensed under CC BY 4.0
Scenario
Objective / Scope
You are an operator for the Hack Smarter Red Team, currently conducting a black-box assessment on a client's external login portal. As part of the initial reconnaissance phase, our OSINT analysts have compiled a list of potential usernames.
You need to identify which one is a valid username for the web application.
Recon
We use rustscan -b 500 -a 10.1.216.45 -- -sC -sV -Pn to enumerate all TCP ports on the target machine, piping the discovered results into Nmap which runs default NSE scripts -sC, service and version detection -sV, and treats the host as online without ICMP echo -Pn.
A batch size of 500 trades speed for stability, the default 1500 balances both, while much larger sizes increase throughput but risk missed responses and instability.
Like in the scope defined our target has a web server running on port 80.
Next, we run a Feroxbuster scan and detect a login and reset page.
We visit the login page and try to use arbitrary credentials, but we do not receive any response of success or failure to enumerate any users here.
We capture a login request using BurpSuite to identify the request made for later use in FFuF.
Next, we move on to the reset password page.
Here too, we do not receive any response to enumerate a valid user.
We capture a reset request using BurpSuite to identify the request made for later use in FFuF.
Username Enumeration
Maybe we have missed something, and the response might differ with a valid user, but a wrong password. We try to log in with the usernames provided from the scenario and filter by the response size, but without success.
We repeat that for the reset page, but again without success.
So what could we have overlooked? Well, when a reset is performed, it is possible that additional functions are triggered for a valid user, such as sending an email, which could lead to a delay. So we could inspect the duration the request required. With 301 usernames we could find it already in this reset attempts made using FFuF.
We filter for request that take longer than the usual 100 - 200ms. In this case more than 500ms and are. able to spot one request that took 1000ms for the valid user.
Further Reading
A comprehensive guide on user enumeration on web applications can be found here:
Last updated
Was this helpful?