Enumeration Attack

Overview

An enumeration attack infers which values exist by comparing application responses, timing, status codes, error messages, password-reset behavior, or rate-limit differences. Targets can include usernames, email addresses, wallet resources, API objects, network services, and sequential identifiers.

Discovered values help attackers focus credential stuffing, phishing, account takeover, data scraping, or authorization attacks. Even when responses display identical text, measurable timing or workflow differences may still reveal whether a target is valid.

Defenses include uniform responses, consistent timing where practical, unpredictable identifiers, authorization before object disclosure, rate and velocity limits, bot detection, and monitoring for systematic probes. Recovery and registration flows require the same protections as primary login endpoints.

Enumeration Attack is an attack or weakness pattern that systematically tests inputs or responses to discover valid accounts, identifiers, resources, services, or other hidden information. Enumeration turns small response differences into a target list, so every identity and recovery workflow must limit observable distinctions.

Assessment of Enumeration Attack should trace an attack or weakness pattern that systematically tests inputs or responses to discover valid accounts, identifiers, resources, services, or other hidden information from prerequisite and entry point through observable impact on the affected service. A theoretical weakness or scanner result involving attack, weakness pattern that systematically tests inputs, and responses to discover valid accounts should not be reported as exploitation without corroborating logs, transactions, or configuration evidence. Prevention, detection, containment, and recovery for the Enumeration attack path should be tested against the architecture associated with attack, weakness pattern that systematically tests inputs, and responses to discover valid accounts.

Retesting for Enumeration Attack should reproduce the Enumeration attack path involving attack, weakness pattern that systematically tests inputs, and responses to discover valid accounts, examine adjacent paths, and verify the conditions for safely returning the affected service to normal operation.