CompTIA PenTest+ (PT0-003)Vulnerability Discovery and AnalysisMedium

A penetration tester is performing a web application assessment and encounters a login form. When attempting to log in with common credentials, the application responds with a generic "Invalid username or password" message, even for valid usernames paired with incorrect passwords. The tester suspects that a username enumeration vulnerability might exist. Which of the following Burp Suite features would be most effective for systematically testing this hypothesis?

  1. ABurp Repeater for manually modifying requests.
  2. BBurp Intruder with a 'Battering ram' attack type.
  3. CBurp Proxy's intercept and modify function.
  4. DBurp Scanner's active scan checks for SQL injection.
Show answer & explanation

Correct answer: B. Burp Intruder with a 'Battering ram' attack type.

Burp Intruder, specifically with a 'Battering ram' attack type, is designed for systematically iterating through a single payload position with a list of values, making it ideal for testing username enumeration by submitting a list of usernames while keeping the password constant.

Why the other options are wrong

  • A. Burp Repeater is for manually replaying and modifying single requests, which is less efficient for iterating through a large list of usernames.
  • C. Burp Proxy intercepts and modifies requests in real-time but doesn't automate systematic iteration through a list of payloads for enumeration.
  • D. Burp Scanner is for identifying vulnerabilities, but Intruder is more suitable for focused, systematic payload testing for enumeration.

Username Enumeration

A vulnerability where an attacker can determine valid usernames from an application's response, typically by observing different error messages or response times for valid versus invalid usernames.

  • Applications should return generic error messages for both invalid username and password.
  • Can be exploited to create targeted password spraying lists.
  • Often detected by observing HTTP response codes, body content, or timing differences.

Memory trick: Usernames are keys to the kingdom; enumerate them wisely.

More Vulnerability Discovery and Analysis questions