PageinSec

Why user enumeration is important -- We can think of a login attempt like this: username + password = [successful login] -At a large organization, we can be pretty sure that at least one account will have a weak or common password (Spring2023, Ilovemyjob2023!, etc). -This makes it a problem of finding the right username rather than the right password So if we instead view the 'password' as a known value (within probably 100 passwords), we only have one variable to solve: username + 'Spring@2023' = [successful login] The username is the hard part to find, not the weak password, which we can assume exists in many (most?) AD environments. If we can enumerate valid users, then we can reduce our list of attempted usernames per-spray from an order of 10,000,000+ to 1,000 or so. Password spraying 1,000 known valid accounts is much faster than 10m unknown. Enumeration is an investment on your password sprays. You invest time up front enumerating, and you are paid back with targeted, fast sprays down the line. If we reach 100% user enum (improbable), what are the odds that at least one AD account has a bad password set, that falls in the top 100 most common passwords list? The more time spent spraying, the more passwords an attacker can cycle through, and user enumeration is the key that allows them to do it in a timely manner. In a matter of months, an attacker could easily go through a top 500 passwords list with a targeted list of users. If user enumeration wasn't possible, it would increase the time investment of an attacker substantially, and likely render the attack unfeasible. User enumeration doesn't have to exist. It's an unnecessary design choice.