Study. uk . com
  1. Home
  2. All questions
  3. Question 283

CompTIA Security+ study material · question 283 of 611

A login form replies "no such user" for unknown addresses and "incorrect password" for known ones. What does this enable?

  1. Credential stuffing
  2. Account enumeration
  3. Privilege escalation
  4. Session fixation
Show the answer

Answer: B. Account enumeration

Distinct messages let an attacker confirm which addresses are registered before spending any guesses on passwords.

Source: OWASP Authentication Cheat Sheet (OWASP) — OWASP Authentication Cheat Sheet › Authentication Responses

Challenge yourself on this topic → Study as cards