What is an Enumeration Attack? How to Prevent It?

When hackers use brute-force techniques to see if specific data is present in a web server database, this is known as an enumeration attack. This information can include usernames and passwords for straightforward enumeration attacks. More sophisticated attacks could confirm bad network setups and reveal hostnames, SNMP, and DNS information.

Every web application module that interacts with a user database has the potential to develop into a vector for an enumeration attack if left exposed.

The following two web applications are frequently the subject of enumeration attacks −

• The password-reset page

• The login page

Enumeration is a crucial part of penetration testing since the flaws that enable these attacks to allow hackers to bypass an information security barrier.

How Do Enumeration Attacks Work?

In an enumeration attack, hackers search for distinctive server answers that attest to the accuracy of submitted credentials. After submitting an online form, the most obvious response is a field authentication message. We’ll use an illustration of a username enumeration attack− where attackers try to locate usernames in a web server database−to describe this procedure.

Utilizing Server Response Times to Validate Entries

The optimal setting for cyberattacks is the feedback system described above. Server responses validating form entries are typically far more nuanced. Monitoring server response times with penetration testing tools is a more complex strategy. Server responses to invalid username entries typically take longer than responses to acceptable username submissions.

Attacks on Username Enumeration

Typically, the first phase of this assault sequence focuses just on usernames. Finding the most legitimate usernames in a database is the goal at this point. A non-existent username will be identified by a webserver with weak application security with an invalid username message.

A threat actor can verify that the username is not present in the webserver database because this message simply validates the username’s validity. Once a significant number of verified usernames has been obtained, a cybercriminal will submit the same password with various username variations.

Username variations can be produced via brute force attack methods or in lists of stolen credentials that have been acquired. Then, cybercriminals will repeat the procedure with passwords, employing brute force methods against all verified accounts until a successful combination is attained.

Any web app function that contains database verifications in its procedures is vulnerable to this kind of attack. Web application developers should steer clear of predictable time sequences to prevent hackers from establishing connections between server response timings and legitimate data entries. Random time periods should be added to server answers to account for both correct and wrong entries.

Complex Enumeration Attack Examples

Reconnaissance missions employ complex enumeration techniques to find explorable software vulnerabilities. Below is a list of a few instances of these attacks.

Enumeration of LDAP

Access to directory services, which include hierarchical structures of user records, is done through the Light-Weight Directory Access Protocol (LDAP).

The following sensitive data could be exposed by a successful LDAP enumeration attack −

• Usernames and Addresses

• Contact details

• Information on the business sector.

NetBIOS Enumeration

Endpoints can access LAN resources thanks to the NetBIOS Enumeration Network Basic Input Output System (NetBIOS) API.

• A 16-character string that is specific to each NetBIOS protocol is used to identify network devices through TCP/IP.

• Printer and file services need to be enabled in order to support NetBIOS enumeration attacks.

• The Microsoft Operating System’s port 139 is the target of these attacks.

The following attacks on the compromised machine might be feasible following a successful NetBIOS enumeration attempt.

• It’s possible for the infected endpoint to join a botnet and be used to carry out DDoS assaults.

• To access critical resources, the thieves could use additional enumerated privileged access accounts.

SNMP Enumeration

A framework for getting or changing data from networked devices is called Simple Network Management Protocol (SNMP). Networked devices can access SNMP regardless of the software they are using because it is software agnostic.

SNMP is enumerated by cyberattacks on remote devices to get the following information −

• Traffic patterns

• Identifiers for distant devices

• Identification of data about networked resources and devices

How to Prevent Enumeration Attacks?

The following list includes some cybersecurity measures that could thwart all kinds of enumeration attacks.

• Multi-Factor Authentication (MFA) − By enforcing MFA at the point of login, cybercriminals are prevented from accessing any server replies without first providing the proper authentication tokens. It is extremely unlikely that the different endpoints that receive these tokens were also compromised by cyber attackers.

• Use CAPTCHA on all forms − Although CAPTCHAs are less effective than MFA at preventing automated enumeration attacks, they do so.

• Reduce the number of login attempts; MFA and CAPTCHAS make it more difficult for hackers to log in, which slows down their attacks. Rate-limiting, which prevents the login process after a predetermined number of failed attempts from the same IP address, can make things even more frustrating.

• Use a Web Application Firewall (WAF) to prevent unauthorized login attempts from a single IP address.

• Implement cyber awareness training − Teach personnel to recognize typical strategies, such as social engineering and phishing, used to steal sensitive data outside of enumeration procedures.

If a login form uses an API, obfuscate the replies so that they do not reveal the validity of each field entry.