{"id":1335,"date":"2023-04-14T15:28:00","date_gmt":"2023-04-14T07:28:00","guid":{"rendered":"https:\/\/systw.net\/note\/?p=1335"},"modified":"2024-05-21T23:07:29","modified_gmt":"2024-05-21T15:07:29","slug":"username-enumeration","status":"publish","type":"post","link":"https:\/\/systw.net\/note\/archives\/1335","title":{"rendered":"Username enumeration"},"content":{"rendered":"\n<p><\/p>\n\n\n\n<p>\u4f7f\u7528\u8005\u540d\u7a31\u5217\u8209<code>Username enumeration<\/code>\u662f\u6307\u653b\u64ca\u8005\u80fd\u5920\u89c0\u5bdf\u7db2\u7ad9\u884c\u70ba\u7684\u8b8a\u5316\uff0c\u4ee5\u78ba\u5b9a\u7d66\u5b9a\u7684\u4f7f\u7528\u8005\u540d\u7a31\u662f\u5426\u6709\u6548\u3002\u5728\u5617\u8a66\u66b4\u529b\u7834\u89e3\u767b\u5165\u9801\u9762\u6642\uff0c\u9700\u7279\u5225\u6ce8\u610f\u4ee5\u4e0b\u65b9\u9762\u7684\u4efb\u4f55\u5dee\u7570\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Status codes(\u72c0\u614b\u78bc):&nbsp; &nbsp;\u5728\u66b4\u529b\u653b\u64ca\u671f\u9593\uff0c\u50b3\u56de\u7684 HTTP \u72c0\u614b\u78bc\u5c0d\u65bc\u7d55\u5927\u591a\u6578\u731c\u6e2c\u4f86\u8aaa\u53ef\u80fd\u90fd\u662f\u76f8\u540c\u7684\uff0c\u56e0\u70ba\u5927\u591a\u6578\u731c\u6e2c\u90fd\u662f\u932f\u8aa4\u7684\u3002\u5982\u679c\u731c\u6e2c\u8fd4\u56de\u4e0d\u540c\u7684\u72c0\u614b\u4ee3\u78bc\uff0c\u5247\u5f37\u70c8\u8868\u793a\u4f7f\u7528\u8005\u540d\u7a31\u662f\u6b63\u78ba\u7684\u3002<\/li>\n\n\n\n<li>Error messages(\u932f\u8aa4\u8a0a\u606f):&nbsp; \u6709\u6642\u50b3\u56de\u7684\u932f\u8aa4\u8a0a\u606f\u6703\u6709\u6240\u4e0d\u540c\uff0c\u53d6\u6c7a\u65bc\u4f7f\u7528\u8005\u540d\u7a31\u548c\u5bc6\u78bc\u662f\u5426\u4e0d\u6b63\u78ba\u6216\u50c5\u5bc6\u78bc\u4e0d\u6b63\u78ba\u3002<\/li>\n\n\n\n<li>Response times(\u56de\u61c9\u6642\u9593):&nbsp;&nbsp; \u5982\u679c\u5927\u591a\u6578\u8acb\u6c42\u90fd\u4ee5\u76f8\u4f3c\u7684\u56de\u61c9\u6642\u9593\u8655\u7406\uff0c\u5247\u4efb\u4f55\u504f\u96e2\u6b64\u6642\u9593\u7684\u60c5\u6cc1\u90fd\u8868\u793a\u5e55\u5f8c\u767c\u751f\u4e86\u4e0d\u540c\u7684\u4e8b\u60c5\u3002<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-dots\"\/>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u7528\u932f\u8aa4\u8a0a\u606f\u5217\u8209\u5e33\u865f<\/h2>\n\n\n\n<p>\u8209\u4f8b\u5982\u4e0b<\/p>\n\n\n\n<p>1.\u89c0\u5bdf\u67d0\u7db2\u7ad9\u767c\u73fe\uff0c\u5982\u679c\u767b\u5165\u6642\u5e33\u865f\u4e0d\u5b58\u5728\uff0c\u6703\u8fd4\u56deinvalid\uff0c\u56e0\u6b64\u53ef\u4ee5\u5229\u7528\u9019\u500b\u7279\u6027\uff0c\u5217\u8209\u51fa\u5b58\u5728\u7684\u4f7f\u7528\u8005<\/p>\n\n\n\n<p>\u53ef\u5728Intruder-&gt;Positions \u8a2d\u5b9a&nbsp;username=\u00a7invalid-username\u00a7  \u505a\u6279\u91cf\u5617\u8a66\uff0c\u904e\u6ffe\u6389invalid\u5f8c\uff0c\u5c31\u6703\u767c\u73fe\u6709\u4e00\u500b\u5e33\u865f\u662f\u8fd4\u56deIncorrect password\uff0c\u9019\u8868\u793a\u8a72\u5e33\u865f\u5b58\u5728<\/p>\n\n\n\n<p>2.\u63a5\u8457\u53ef\u4ee5\u5c0d\u5df1\u5b58\u5728\u7684\u5e33\u865fidentifiedUser\u505a\u5bc6\u78bc\u7206\u529b\u7834\u89e3<\/p>\n\n\n\n<p>\u53ef\u5728Intruder-&gt;Positions\u8a2d\u5b9a username=identifiedUser&amp;password=\u00a7invalid-password\u00a7  \u505a\u6279\u91cf\u5617\u8a66\uff0c\u89c0\u5bdf\u767c\u73fe\uff0c\u7576\u8fd4\u56de302\u6642\u8868\u793a\u5bc6\u78bc\u6b63\u78ba\uff0c\u6210\u529f\u767b\u5165\u5df1\u5b58\u5728\u7684\u5e33\u6236<\/p>\n\n\n\n<p>Lab: Username enumeration via different responses<\/p>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-dots\"\/>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u5229\u7528\u5fae\u5c0f\u5dee\u7570\u5217\u8209\u5e33\u865f <\/h2>\n\n\n\n<p>\u8209\u4f8b\u5982\u4e0b<\/p>\n\n\n\n<p>\u89c0\u5bdf\u67d0\u7db2\u7ad9\u767c\u73fe\uff0c\u5982\u679c\u767b\u5165\u6642\u5e33\u865f\u5931\u6557\uff0c\u6703\u8fd4\u56de Invalid username or password<\/p>\n\n\n\n<p>\u4f46\u4ed4\u7d30\u89c0\u5bdf\u6703\u767c\u73fe\u4ee5\u4e0b\u73fe\u8c61<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u7528\u6236\u4e0d\u5b58\u5728\uff0c \u8fd4\u56deInvalid username or password.<\/li>\n\n\n\n<li>\u7528\u6236\u5b58\u5728\u4f46\u8f38\u5165\u932f\u8aa4\u5bc6\u78bc\uff0c\u8fd4\u56deInvalid username or password<code> <\/code>\uff0c\u4f46\u5f8c\u9762\u5305\u542b\u4e00\u500b\u7a7a\u767d<\/li>\n<\/ul>\n\n\n\n<p>\u56e0\u6b64\u53ef\u4ee5\u5229\u7528\u9019\u500b\u65b9\u5f0f\u5217\u8209\u5df1\u5b58\u5728\u4f7f\u7528\u8005<\/p>\n\n\n\n<p>Lab: Username enumeration via subtly different responses<\/p>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-dots\"\/>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u5229\u7528\u6642\u9593\u5dee\u5217\u8209\u5e33\u865f<\/h2>\n\n\n\n<p>\u8209\u4f8b\u5982\u4e0b<\/p>\n\n\n\n<p>\u4ed4\u7d30\u89c0\u5bdf\u67d0\u7db2\u7ad9\u767c\u73fe\uff0c \u767b\u5165\u5e33\u865f\u5931\u6557\u6642\u7db2\u7ad9\u6703\u6709\u5169\u7a2e\u8b8a\u5316<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u7528\u6236\u4e0d\u5b58\u5728\uff0c \u56de\u61c9\u6642\u9593\u8f03\u5feb<\/li>\n\n\n\n<li>\u7528\u6236\u5b58\u5728\u4f46\u8f38\u5165\u8d85\u9577\u7684\u932f\u8aa4\u5bc6\u78bc\uff0c\u56de\u61c9\u6642\u9593\u8f03\u4e45<\/li>\n<\/ul>\n\n\n\n<p>\u56e0\u6b64\u53ef\u4ee5\u5229\u7528\u9019\u500b\u65b9\u5f0f\u5217\u8209\u5df1\u5b58\u5728\u4f7f\u7528\u8005<\/p>\n\n\n\n<p>\u4f46\u76ee\u6a19\u7db2\u7ad9\u5728\u767b\u5165\u5931\u6557\u6b21\u6578\u592a\u591a\u6642\uff0c\u5b89\u5168\u6a5f\u5236\u6703\u5c01\u9396IP\uff0c\u4e0d\u904e\u5b89\u5168\u6a5f\u5236\u662f\u7528X-Forwarded-For\u4f86\u5224\u65b7IP\uff0c\u6240\u4ee5\u53ea\u8981\u6bcf\u6b21\u8acb\u6c42\u6642\u90fd\u66f4\u6539X-Forwarded-For\uff0c\u5c31\u53ef\u4ee5\u9952\u904e\u5b89\u5168\u6a5f\u5236<\/p>\n\n\n\n<p>\u6839\u64da\u4ee5\u4e0a\u7684\u89c0\u5bdf\uff0c\u53ef\u4ee5\u5c07\u767b\u5165\u8acb\u6c42\u653e\u5165Intruder\uff0c Positions\u8a2d\u5b9a\u4ee5\u4e0b\uff0c\u653b\u64ca\u985e\u578b\u70baPitchfork<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>POST \/login HTTP\/1.1\n...omit...\nX-Forwarded-For: \u00a7payload1\u00a7\n\nusername=\u00a7payload2\u00a7&amp;password=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa<\/code><\/pre>\n\n\n\n<p>payload set 1: payload type\u9078\u64c7Numbers, \u4e26\u8a2d\u5b9a from: 1, to:1000, step: 1 <\/p>\n\n\n\n<p>payload set 2: payload type\u9078\u64c7simple list, \u4e26\u8cbc\u4e0a\u8981\u6e2c\u8a66\u7684\u4f7f\u7528\u8005\u6e05\u55ae<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><\/li>\n<\/ol>\n\n\n\n<p>\u63a5\u8457\u6309\u4e0bStart the attack\uff0c\u5c31\u53ef\u4ee5results table\u89c0\u5bdfResponse received\u548cResponse completed\u6b04\u4f4d\uff0c\u5206\u6790\u90a3\u4e00\u500b\u7528\u6236\u7684\u53cd\u61c9\u6642\u9593\u6700\u4e45\uff0c\u800c\u9019\u500b\u7528\u6236\u5c31\u662f\u5df1\u5b58\u5728\u7684\u7528\u6236<\/p>\n\n\n\n<p> Lab: Username enumeration via response timing<\/p>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-dots\"\/>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u900f\u904e\u5e33\u6236\u9396\u5b9a\u5217\u8209\u7528\u6236\u540d<\/h2>\n\n\n\n<p>\u8209\u4f8b\u5982\u4e0b<\/p>\n\n\n\n<p>\u89c0\u5bdf\u67d0\u7db2\u7ad9\u767c\u73fe\uff0c\u5bc6\u78bc\u8f38\u5165\u4e09\u6b21\u6709\u4e0d\u540c\u7684\u53cd\u61c9<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u7528\u6236\u4e0d\u5b58\u5728\uff0c \u8f38\u5165\u4e09\u6b21\u4ee5\u4e0a\u932f\u8aa4\u6c92\u4e8b<\/li>\n\n\n\n<li>\u7528\u6236\u5b58\u5728\u4f46\u8f38\u5165\u932f\u8aa4\u5bc6\u78bc\uff0c\u8f38\u5165\u4e09\u6b21\u4ee5\u4e0a\u932f\u8aa4\uff0c\u5e33\u6236\u6703\u88ab\u9396\u5b9a<\/li>\n<\/ul>\n\n\n\n<p>\u56e0\u6b64\u53ef\u4ee5\u5229\u7528\u9019\u500b\u65b9\u5f0f\u5217\u8209\u5df1\u5b58\u5728\u4f7f\u7528\u8005<\/p>\n\n\n\n<p>Lab: Username enumeration via account lock<\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u4f7f\u7528\u8005\u540d\u7a31\u5217\u8209Username enumeration\u662f\u6307\u653b\u64ca\u8005\u80fd\u5920\u89c0\u5bdf\u7db2\u7ad9\u884c\u70ba\u7684\u8b8a\u5316\uff0c\u4ee5\u78ba\u5b9a\u7d66\u5b9a\u7684\u4f7f\u7528\u8005\u540d\u7a31\u662f\u5426\u6709\u6548\u3002\u5728\u5617\u8a66\u66b4\u529b\u7834\u89e3\u767b\u5165\u9801\u9762\u6642\uff0c\u9700\u7279\u5225\u6ce8\u610f\u4ee5\u4e0b\u65b9\u9762\u7684\u4efb\u4f55\u5dee\u7570<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[367],"tags":[],"class_list":["post-1335","post","type-post","status-publish","format-standard","hentry","category-logic-vulnerabilities"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/1335","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/comments?post=1335"}],"version-history":[{"count":0,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/1335\/revisions"}],"wp:attachment":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/media?parent=1335"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/categories?post=1335"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/tags?post=1335"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}