Original subtitles

welcome back in the demo

uh user enumeration so let me start with

the login functionality

let me as i um already explained to you

in the previous video let me start with

existing email and non-existing email

and

let's see how the web application

responds so my email is david

example.com well i am the user of this

web application i am registered out

there so

well i know that this is uh you know

existing

uh email and now i'm gonna provide some

arbitrary password right i just wanna

see if the web application is going to

tell me something about this email if

this is

registered email or not well i know that

this is registered email but

you know in case of other emails i don't

know it so i just have to

see how the web application responds

because

this is something what i need to learn

to see if other emails are registered or

not right

so let me now click login and let's

see the response wrong

email and or password

well when you've got this message you

don't know what is wrong

email and or password so now let's try

with

some arbitrary email like whatever

add whatever dot com and arbitrary

password

let's see how it works for non-existing

email right

wrong email and or password the same

response

so i have completely no chance to learn

anything here right

providing existing email non-existing

email or in other words

registered or not registered i cannot

figure out

which one is registered and which one is

not right

okay but as i told you uh don't give up

hackers are smart and hackers will

try to reach their goal in a number of

different ways

now let me go to forgot password

functionality

in forgot password functionality i'm

asked to enter my email and then the

password reset link

will be sent to this email so now when i

provide my email

here and i click send password reset

link

then i see a message password reset link

has been sent to your email

that's cool that's cool but how does the

web app responds

to non-existing email let's check this

out

whatever add whatever right dot com

send password reset link

email doesn't exist so

yeah we've got it we've got it we have

found

that user enumeration via forgot

password functionality is possible

because the system responds differently

the web app

responds differently for registered

email

and non-registered email right and this

is how you can start

building a list of registered emails

now do some kind of automation here

and voila you will learn who's register

who is not

and that's it i've got two different

types of responses for registered emails

and unregistered emails this is it this

is how it works

and in a real attack the attacker would

do some kind of automation here but when

you do hacking

you need to provide a kind of proof of

concept you need to

show the program owner or the company

how you can

build this list of registered emails

and what i explained to you is is enough

right

we see in forgot password functionality

two different

uh responses for registered and

unregistered emails and this is how we

can differentiate

who is registered who is not registered

this is how we can start building

uh this list and here is how the

attacker

can build this list as well so you see

try to be smart don't give up too early

try also other functionalities in the in

the web application if you've got a goal

in your mind

try to be open-minded and and then you

can reach your goal

i believe that this is clear and

basically this is it in this demo