Question

During a web application assessment, you observe that a custom login endpoint returns the response 'Invalid password for user' when a valid username is submitted with a wrong password, but returns 'Unknown account' when the username does not exist. Additionally, requests for valid usernames take noticeably longer to process. Which vulnerability class does this behavior most directly represent, and how would you leverage it?

Accepted Answer

Username enumeration via differential error messages and response timing, which you can use to build a validated list of accounts for a targeted password-spraying attack

Answer

SQL injection in the authentication query, which you can exploit by inserting a UNION-based payload into the username field to dump the user table

Answer

Session fixation, which you can exploit by forcing a known session identifier onto the victim before they authenticate

Answer

Insecure direct object reference, which you can exploit by incrementing a numeric account ID to access other users' profiles