So vermeiden Sie die Aufzählung von Nutzernamen | Secure Code Warrior
A side-channel attack is when a hacker can gather information from the physical implementation of a software system rather than a theoretical weakness in the algorithm or bug in the code of the software.
An example I like to use to make this more clear is a way to do username enumeration. If you want to know what username enumeration is or why it is bad, visit our website for a video explanation or play a challenge to see if you can identify it in code.
Now in order to understand how username enumeration can be done through a side-channel attack, you need to have some understanding of how passwords are (or at least should be) handled in modern web applications. A good web application doesn't know your password, it doesn't save or store your password anywhere. So how does it know that what you typed is correct and in fact your password? Well, your password is hashed.
A hashing function is a mathematical operation that is easy to perform one way (although somewhat computationally expensive) but very difficult to reverse and for good hashing algorithms, the output is unique depending on the input. When you register on a website, that hash is stored safely, not your password itself. That means that every time you log-in, the web application hashes your input and compares the hashed results to the stored hash. If you want to learn more about secure password storage, you can do that on our platform.
Hashing input takes some time on a computer and developers always try to optimize everything they write in order for the users to have a smooth experience. One thing that speeds up the program is to skip the hashing when it is not needed. For example, when the username does not exist (and so no password needs to be checked) they can respond to the user immediately. This way they can skip the slow computation of hashing the password. If the username was correct they will hash the password input and compare that to the stored hash.
At this point, you might have guessed where things can go wrong. Even though in reality the hashing takes only a few milliseconds, a hacker can use this added delay to find out if the username he entered was correct or not since a wrong username will have a slightly faster response because no hashing was done. This type of side-channel attack is called a timing attack and it is a good example for how different non-functional requirements can counteract each other. Sometimes code cannot be fast and secure at the same time.
So even though the passwords are handled perfectly, and the message that is displayed is generic and does not advise whether the password or username was incorrect, the system is still vulnerable. The solution is easy, always hash the password or delay sending the reply the time it would take to hash.
The information obtained can be used by an attacker to gain a list of users on system. This information can be used to attack the web application, for example, through a brute force or default username/password attack.
Bei der Aufzählung von Benutzernamen verwenden Hacker Brute-Force-Angriffe, um Informationen zu Benutzernamen und Passwörtern zu erhalten. Erfahren Sie, wie Sie die Aufzählung von Benutzernamen mit Secure Code Warrior vermeiden können.
Forscher für Anwendungssicherheit - Forschungs- und Entwicklungsingenieur - Doktorand
Secure Code Warrior ist für Ihr Unternehmen da, um Ihnen zu helfen, Code während des gesamten Softwareentwicklungszyklus zu sichern und eine Kultur zu schaffen, in der Cybersicherheit an erster Stelle steht. Ganz gleich, ob Sie AppSec-Manager, Entwickler, CISO oder jemand anderes sind, der sich mit Sicherheit befasst, wir können Ihrem Unternehmen helfen, die mit unsicherem Code verbundenen Risiken zu reduzieren.
Eine Demo buchen
Forscher für Anwendungssicherheit - Forschungs- und Entwicklungsingenieur - Doktorand
A side-channel attack is when a hacker can gather information from the physical implementation of a software system rather than a theoretical weakness in the algorithm or bug in the code of the software.
An example I like to use to make this more clear is a way to do username enumeration. If you want to know what username enumeration is or why it is bad, visit our website for a video explanation or play a challenge to see if you can identify it in code.
Now in order to understand how username enumeration can be done through a side-channel attack, you need to have some understanding of how passwords are (or at least should be) handled in modern web applications. A good web application doesn't know your password, it doesn't save or store your password anywhere. So how does it know that what you typed is correct and in fact your password? Well, your password is hashed.
A hashing function is a mathematical operation that is easy to perform one way (although somewhat computationally expensive) but very difficult to reverse and for good hashing algorithms, the output is unique depending on the input. When you register on a website, that hash is stored safely, not your password itself. That means that every time you log-in, the web application hashes your input and compares the hashed results to the stored hash. If you want to learn more about secure password storage, you can do that on our platform.
Hashing input takes some time on a computer and developers always try to optimize everything they write in order for the users to have a smooth experience. One thing that speeds up the program is to skip the hashing when it is not needed. For example, when the username does not exist (and so no password needs to be checked) they can respond to the user immediately. This way they can skip the slow computation of hashing the password. If the username was correct they will hash the password input and compare that to the stored hash.
At this point, you might have guessed where things can go wrong. Even though in reality the hashing takes only a few milliseconds, a hacker can use this added delay to find out if the username he entered was correct or not since a wrong username will have a slightly faster response because no hashing was done. This type of side-channel attack is called a timing attack and it is a good example for how different non-functional requirements can counteract each other. Sometimes code cannot be fast and secure at the same time.
So even though the passwords are handled perfectly, and the message that is displayed is generic and does not advise whether the password or username was incorrect, the system is still vulnerable. The solution is easy, always hash the password or delay sending the reply the time it would take to hash.
The information obtained can be used by an attacker to gain a list of users on system. This information can be used to attack the web application, for example, through a brute force or default username/password attack.
A side-channel attack is when a hacker can gather information from the physical implementation of a software system rather than a theoretical weakness in the algorithm or bug in the code of the software.
An example I like to use to make this more clear is a way to do username enumeration. If you want to know what username enumeration is or why it is bad, visit our website for a video explanation or play a challenge to see if you can identify it in code.
Now in order to understand how username enumeration can be done through a side-channel attack, you need to have some understanding of how passwords are (or at least should be) handled in modern web applications. A good web application doesn't know your password, it doesn't save or store your password anywhere. So how does it know that what you typed is correct and in fact your password? Well, your password is hashed.
A hashing function is a mathematical operation that is easy to perform one way (although somewhat computationally expensive) but very difficult to reverse and for good hashing algorithms, the output is unique depending on the input. When you register on a website, that hash is stored safely, not your password itself. That means that every time you log-in, the web application hashes your input and compares the hashed results to the stored hash. If you want to learn more about secure password storage, you can do that on our platform.
Hashing input takes some time on a computer and developers always try to optimize everything they write in order for the users to have a smooth experience. One thing that speeds up the program is to skip the hashing when it is not needed. For example, when the username does not exist (and so no password needs to be checked) they can respond to the user immediately. This way they can skip the slow computation of hashing the password. If the username was correct they will hash the password input and compare that to the stored hash.
At this point, you might have guessed where things can go wrong. Even though in reality the hashing takes only a few milliseconds, a hacker can use this added delay to find out if the username he entered was correct or not since a wrong username will have a slightly faster response because no hashing was done. This type of side-channel attack is called a timing attack and it is a good example for how different non-functional requirements can counteract each other. Sometimes code cannot be fast and secure at the same time.
So even though the passwords are handled perfectly, and the message that is displayed is generic and does not advise whether the password or username was incorrect, the system is still vulnerable. The solution is easy, always hash the password or delay sending the reply the time it would take to hash.
The information obtained can be used by an attacker to gain a list of users on system. This information can be used to attack the web application, for example, through a brute force or default username/password attack.
Klicken Sie auf den Link unten und laden Sie das PDF dieser Ressource herunter.
Secure Code Warrior ist für Ihr Unternehmen da, um Ihnen zu helfen, Code während des gesamten Softwareentwicklungszyklus zu sichern und eine Kultur zu schaffen, in der Cybersicherheit an erster Stelle steht. Ganz gleich, ob Sie AppSec-Manager, Entwickler, CISO oder jemand anderes sind, der sich mit Sicherheit befasst, wir können Ihrem Unternehmen helfen, die mit unsicherem Code verbundenen Risiken zu reduzieren.
Bericht ansehenEine Demo buchen
Forscher für Anwendungssicherheit - Forschungs- und Entwicklungsingenieur - Doktorand
A side-channel attack is when a hacker can gather information from the physical implementation of a software system rather than a theoretical weakness in the algorithm or bug in the code of the software.
An example I like to use to make this more clear is a way to do username enumeration. If you want to know what username enumeration is or why it is bad, visit our website for a video explanation or play a challenge to see if you can identify it in code.
Now in order to understand how username enumeration can be done through a side-channel attack, you need to have some understanding of how passwords are (or at least should be) handled in modern web applications. A good web application doesn't know your password, it doesn't save or store your password anywhere. So how does it know that what you typed is correct and in fact your password? Well, your password is hashed.
A hashing function is a mathematical operation that is easy to perform one way (although somewhat computationally expensive) but very difficult to reverse and for good hashing algorithms, the output is unique depending on the input. When you register on a website, that hash is stored safely, not your password itself. That means that every time you log-in, the web application hashes your input and compares the hashed results to the stored hash. If you want to learn more about secure password storage, you can do that on our platform.
Hashing input takes some time on a computer and developers always try to optimize everything they write in order for the users to have a smooth experience. One thing that speeds up the program is to skip the hashing when it is not needed. For example, when the username does not exist (and so no password needs to be checked) they can respond to the user immediately. This way they can skip the slow computation of hashing the password. If the username was correct they will hash the password input and compare that to the stored hash.
At this point, you might have guessed where things can go wrong. Even though in reality the hashing takes only a few milliseconds, a hacker can use this added delay to find out if the username he entered was correct or not since a wrong username will have a slightly faster response because no hashing was done. This type of side-channel attack is called a timing attack and it is a good example for how different non-functional requirements can counteract each other. Sometimes code cannot be fast and secure at the same time.
So even though the passwords are handled perfectly, and the message that is displayed is generic and does not advise whether the password or username was incorrect, the system is still vulnerable. The solution is easy, always hash the password or delay sending the reply the time it would take to hash.
The information obtained can be used by an attacker to gain a list of users on system. This information can be used to attack the web application, for example, through a brute force or default username/password attack.
Inhaltsverzeichniss
Forscher für Anwendungssicherheit - Forschungs- und Entwicklungsingenieur - Doktorand
Secure Code Warrior ist für Ihr Unternehmen da, um Ihnen zu helfen, Code während des gesamten Softwareentwicklungszyklus zu sichern und eine Kultur zu schaffen, in der Cybersicherheit an erster Stelle steht. Ganz gleich, ob Sie AppSec-Manager, Entwickler, CISO oder jemand anderes sind, der sich mit Sicherheit befasst, wir können Ihrem Unternehmen helfen, die mit unsicherem Code verbundenen Risiken zu reduzieren.
Eine Demo buchenHerunterladenRessourcen für den Einstieg
Themen und Inhalte der Securecode-Schulung
Unsere branchenführenden Inhalte werden ständig weiterentwickelt, um der sich ständig ändernden Softwareentwicklungslandschaft unter Berücksichtigung Ihrer Rolle gerecht zu werden. Themen, die alles von KI bis XQuery Injection abdecken und für eine Vielzahl von Rollen angeboten werden, von Architekten und Ingenieuren bis hin zu Produktmanagern und QA. Verschaffen Sie sich einen kleinen Einblick in das Angebot unseres Inhaltskatalogs nach Themen und Rollen.
%20(1).avif)
.avif)
Threat Modeling with AI: Turning Every Developer into a Threat Modeler
Walk away better equipped to help developers combine threat modeling ideas and techniques with the AI tools they're already using to strengthen security, improve collaboration, and build more resilient software from the start.
Ressourcen für den Einstieg
Cybermon is back: Beat the Boss KI-Missionen jetzt auf Abruf verfügbar
Cybermon 2025 Beat the Boss ist jetzt das ganze Jahr über in SCW verfügbar. Setzt fortschrittliche KI/LLM-Sicherheitsanforderungen ein, um die sichere KI-Entwicklung in einem großen Maßstab zu stärken.
Cyber-Resilienz-Gesetz erklärt: Was das für die Entwicklung von Secure by Design-Software bedeutet
Erfahren Sie, was der EU Cyber Resilience Act (CRA) verlangt, für wen er gilt und wie sich Entwicklungsteams mit sicheren Methoden, der Vorbeugung von Sicherheitslücken und dem Aufbau von Fähigkeiten für Entwickler darauf vorbereiten können.
