CompTIA PenTest+ (PT0-003)Vulnerability Discovery and AnalysisMedium
A penetration tester is performing a web application assessment and encounters a login form. When attempting to log in with common credentials, the application responds with a generic "Invalid username or password" message, even for valid usernames paired with incorrect passwords. The tester suspects that a username enumeration vulnerability might exist. Which of the following Burp Suite features would be most effective for systematically testing this hypothesis?
- ABurp Repeater for manually modifying requests.
- BBurp Intruder with a 'Battering ram' attack type.
- CBurp Proxy's intercept and modify function.
- DBurp Scanner's active scan checks for SQL injection.
Show answer & explanationAnswer & explanation
Correct answer: B. Burp Intruder with a 'Battering ram' attack type.
Burp Intruder, specifically with a 'Battering ram' attack type, is designed for systematically iterating through a single payload position with a list of values, making it ideal for testing username enumeration by submitting a list of usernames while keeping the password constant.
Why the other options are wrong
- A. Burp Repeater is for manually replaying and modifying single requests, which is less efficient for iterating through a large list of usernames.
- C. Burp Proxy intercepts and modifies requests in real-time but doesn't automate systematic iteration through a list of payloads for enumeration.
- D. Burp Scanner is for identifying vulnerabilities, but Intruder is more suitable for focused, systematic payload testing for enumeration.
Username Enumeration
A vulnerability where an attacker can determine valid usernames from an application's response, typically by observing different error messages or response times for valid versus invalid usernames.
- Applications should return generic error messages for both invalid username and password.
- Can be exploited to create targeted password spraying lists.
- Often detected by observing HTTP response codes, body content, or timing differences.
Memory trick: Usernames are keys to the kingdom; enumerate them wisely.