Hands-On Bug Hunting for Penetration Testers

Username Enumeration

Savvy sites will contain error messages for sign-up and login pages that don't indicate whether a username exists: invalid credentials are vague enough to make it unclear whether it was the username or password that was incorrect, while the message username already exists instantly tells an attacker that there's a valid user target with that account.

Combined with a script that fuzzes different possible usernames (based on something like a dictionary attack), a determined assailant could create a list of all the site's users. Regardless, because it's so resource-intensive, common, and since it doesn't lead directly to a serious vulnerability like remote code execution, username enumeration does not merit a bug bounty ...