Comment éviter l'énumération des noms d'utilisateur | Secure Code Warrior
A side-channel attack is when a hacker can gather information from the physical implementation of a software system rather than a theoretical weakness in the algorithm or bug in the code of the software.
An example I like to use to make this more clear is a way to do username enumeration. If you want to know what username enumeration is or why it is bad, visit our website for a video explanation or play a challenge to see if you can identify it in code.
Now in order to understand how username enumeration can be done through a side-channel attack, you need to have some understanding of how passwords are (or at least should be) handled in modern web applications. A good web application doesn't know your password, it doesn't save or store your password anywhere. So how does it know that what you typed is correct and in fact your password? Well, your password is hashed.
A hashing function is a mathematical operation that is easy to perform one way (although somewhat computationally expensive) but very difficult to reverse and for good hashing algorithms, the output is unique depending on the input. When you register on a website, that hash is stored safely, not your password itself. That means that every time you log-in, the web application hashes your input and compares the hashed results to the stored hash. If you want to learn more about secure password storage, you can do that on our platform.
Hashing input takes some time on a computer and developers always try to optimize everything they write in order for the users to have a smooth experience. One thing that speeds up the program is to skip the hashing when it is not needed. For example, when the username does not exist (and so no password needs to be checked) they can respond to the user immediately. This way they can skip the slow computation of hashing the password. If the username was correct they will hash the password input and compare that to the stored hash.
At this point, you might have guessed where things can go wrong. Even though in reality the hashing takes only a few milliseconds, a hacker can use this added delay to find out if the username he entered was correct or not since a wrong username will have a slightly faster response because no hashing was done. This type of side-channel attack is called a timing attack and it is a good example for how different non-functional requirements can counteract each other. Sometimes code cannot be fast and secure at the same time.
So even though the passwords are handled perfectly, and the message that is displayed is generic and does not advise whether the password or username was incorrect, the system is still vulnerable. The solution is easy, always hash the password or delay sending the reply the time it would take to hash.
The information obtained can be used by an attacker to gain a list of users on system. This information can be used to attack the web application, for example, through a brute force or default username/password attack.
L'énumération des noms d'utilisateur se produit lorsque les pirates informatiques utilisent des attaques par force brute pour obtenir des informations sur le nom d'utilisateur et le mot de passe. Découvrez comment éviter l'énumération des noms d'utilisateur avec Secure Code Warrior.
Chercheur en sécurité des applications - Ingénieur R&D - Candidat au doctorat
Secure Code Warrior est là pour aider votre organisation à sécuriser le code tout au long du cycle de développement logiciel et à créer une culture dans laquelle la cybersécurité est une priorité. Que vous soyez responsable de la sécurité des applications, développeur, responsable de la sécurité informatique ou toute autre personne impliquée dans la sécurité, nous pouvons aider votre organisation à réduire les risques associés à un code non sécurisé.
Réservez une démo
Chercheur en sécurité des applications - Ingénieur R&D - Candidat au doctorat
A side-channel attack is when a hacker can gather information from the physical implementation of a software system rather than a theoretical weakness in the algorithm or bug in the code of the software.
An example I like to use to make this more clear is a way to do username enumeration. If you want to know what username enumeration is or why it is bad, visit our website for a video explanation or play a challenge to see if you can identify it in code.
Now in order to understand how username enumeration can be done through a side-channel attack, you need to have some understanding of how passwords are (or at least should be) handled in modern web applications. A good web application doesn't know your password, it doesn't save or store your password anywhere. So how does it know that what you typed is correct and in fact your password? Well, your password is hashed.
A hashing function is a mathematical operation that is easy to perform one way (although somewhat computationally expensive) but very difficult to reverse and for good hashing algorithms, the output is unique depending on the input. When you register on a website, that hash is stored safely, not your password itself. That means that every time you log-in, the web application hashes your input and compares the hashed results to the stored hash. If you want to learn more about secure password storage, you can do that on our platform.
Hashing input takes some time on a computer and developers always try to optimize everything they write in order for the users to have a smooth experience. One thing that speeds up the program is to skip the hashing when it is not needed. For example, when the username does not exist (and so no password needs to be checked) they can respond to the user immediately. This way they can skip the slow computation of hashing the password. If the username was correct they will hash the password input and compare that to the stored hash.
At this point, you might have guessed where things can go wrong. Even though in reality the hashing takes only a few milliseconds, a hacker can use this added delay to find out if the username he entered was correct or not since a wrong username will have a slightly faster response because no hashing was done. This type of side-channel attack is called a timing attack and it is a good example for how different non-functional requirements can counteract each other. Sometimes code cannot be fast and secure at the same time.
So even though the passwords are handled perfectly, and the message that is displayed is generic and does not advise whether the password or username was incorrect, the system is still vulnerable. The solution is easy, always hash the password or delay sending the reply the time it would take to hash.
The information obtained can be used by an attacker to gain a list of users on system. This information can be used to attack the web application, for example, through a brute force or default username/password attack.
A side-channel attack is when a hacker can gather information from the physical implementation of a software system rather than a theoretical weakness in the algorithm or bug in the code of the software.
An example I like to use to make this more clear is a way to do username enumeration. If you want to know what username enumeration is or why it is bad, visit our website for a video explanation or play a challenge to see if you can identify it in code.
Now in order to understand how username enumeration can be done through a side-channel attack, you need to have some understanding of how passwords are (or at least should be) handled in modern web applications. A good web application doesn't know your password, it doesn't save or store your password anywhere. So how does it know that what you typed is correct and in fact your password? Well, your password is hashed.
A hashing function is a mathematical operation that is easy to perform one way (although somewhat computationally expensive) but very difficult to reverse and for good hashing algorithms, the output is unique depending on the input. When you register on a website, that hash is stored safely, not your password itself. That means that every time you log-in, the web application hashes your input and compares the hashed results to the stored hash. If you want to learn more about secure password storage, you can do that on our platform.
Hashing input takes some time on a computer and developers always try to optimize everything they write in order for the users to have a smooth experience. One thing that speeds up the program is to skip the hashing when it is not needed. For example, when the username does not exist (and so no password needs to be checked) they can respond to the user immediately. This way they can skip the slow computation of hashing the password. If the username was correct they will hash the password input and compare that to the stored hash.
At this point, you might have guessed where things can go wrong. Even though in reality the hashing takes only a few milliseconds, a hacker can use this added delay to find out if the username he entered was correct or not since a wrong username will have a slightly faster response because no hashing was done. This type of side-channel attack is called a timing attack and it is a good example for how different non-functional requirements can counteract each other. Sometimes code cannot be fast and secure at the same time.
So even though the passwords are handled perfectly, and the message that is displayed is generic and does not advise whether the password or username was incorrect, the system is still vulnerable. The solution is easy, always hash the password or delay sending the reply the time it would take to hash.
The information obtained can be used by an attacker to gain a list of users on system. This information can be used to attack the web application, for example, through a brute force or default username/password attack.
Cliquez sur le lien ci-dessous et téléchargez le PDF de cette ressource.
Secure Code Warrior est là pour aider votre organisation à sécuriser le code tout au long du cycle de développement logiciel et à créer une culture dans laquelle la cybersécurité est une priorité. Que vous soyez responsable de la sécurité des applications, développeur, responsable de la sécurité informatique ou toute autre personne impliquée dans la sécurité, nous pouvons aider votre organisation à réduire les risques associés à un code non sécurisé.
Afficher le rapportRéservez une démo
Chercheur en sécurité des applications - Ingénieur R&D - Candidat au doctorat
A side-channel attack is when a hacker can gather information from the physical implementation of a software system rather than a theoretical weakness in the algorithm or bug in the code of the software.
An example I like to use to make this more clear is a way to do username enumeration. If you want to know what username enumeration is or why it is bad, visit our website for a video explanation or play a challenge to see if you can identify it in code.
Now in order to understand how username enumeration can be done through a side-channel attack, you need to have some understanding of how passwords are (or at least should be) handled in modern web applications. A good web application doesn't know your password, it doesn't save or store your password anywhere. So how does it know that what you typed is correct and in fact your password? Well, your password is hashed.
A hashing function is a mathematical operation that is easy to perform one way (although somewhat computationally expensive) but very difficult to reverse and for good hashing algorithms, the output is unique depending on the input. When you register on a website, that hash is stored safely, not your password itself. That means that every time you log-in, the web application hashes your input and compares the hashed results to the stored hash. If you want to learn more about secure password storage, you can do that on our platform.
Hashing input takes some time on a computer and developers always try to optimize everything they write in order for the users to have a smooth experience. One thing that speeds up the program is to skip the hashing when it is not needed. For example, when the username does not exist (and so no password needs to be checked) they can respond to the user immediately. This way they can skip the slow computation of hashing the password. If the username was correct they will hash the password input and compare that to the stored hash.
At this point, you might have guessed where things can go wrong. Even though in reality the hashing takes only a few milliseconds, a hacker can use this added delay to find out if the username he entered was correct or not since a wrong username will have a slightly faster response because no hashing was done. This type of side-channel attack is called a timing attack and it is a good example for how different non-functional requirements can counteract each other. Sometimes code cannot be fast and secure at the same time.
So even though the passwords are handled perfectly, and the message that is displayed is generic and does not advise whether the password or username was incorrect, the system is still vulnerable. The solution is easy, always hash the password or delay sending the reply the time it would take to hash.
The information obtained can be used by an attacker to gain a list of users on system. This information can be used to attack the web application, for example, through a brute force or default username/password attack.
Table des matières
Chercheur en sécurité des applications - Ingénieur R&D - Candidat au doctorat
Secure Code Warrior est là pour aider votre organisation à sécuriser le code tout au long du cycle de développement logiciel et à créer une culture dans laquelle la cybersécurité est une priorité. Que vous soyez responsable de la sécurité des applications, développeur, responsable de la sécurité informatique ou toute autre personne impliquée dans la sécurité, nous pouvons aider votre organisation à réduire les risques associés à un code non sécurisé.
Réservez une démoTéléchargerRessources pour vous aider à démarrer
Sujets et contenus de formation sur le code sécurisé
Notre contenu de pointe évolue constamment pour s'adapter à l'évolution constante du paysage du développement de logiciels tout en tenant compte de votre rôle. Des sujets couvrant tout, de l'IA à l'injection XQuery, proposés pour une variété de postes, allant des architectes aux ingénieurs en passant par les chefs de produit et l'assurance qualité. Découvrez un aperçu de ce que notre catalogue de contenu a à offrir par sujet et par rôle.
%20(1).avif)
.avif)
Threat Modeling with AI: Turning Every Developer into a Threat Modeler
Walk away better equipped to help developers combine threat modeling ideas and techniques with the AI tools they're already using to strengthen security, improve collaboration, and build more resilient software from the start.
Ressources pour vous aider à démarrer
Cybermon est de retour : les missions d'IA Beat the Boss sont désormais disponibles à la demande
Cybermon 2025 Beat the Boss est désormais disponible toute l'année dans SCW. Déployez des défis de sécurité avancés liés à l'IA et au LLM pour renforcer le développement sécurisé de l'IA à grande échelle.
Explication de la loi sur la cyberrésilience : ce que cela signifie pour le développement de logiciels sécurisés dès la conception
Découvrez ce que la loi européenne sur la cyberrésilience (CRA) exige, à qui elle s'applique et comment les équipes d'ingénieurs peuvent se préparer grâce à des pratiques de sécurité dès la conception, à la prévention des vulnérabilités et au renforcement des capacités des développeurs.
Facilitateur 1 : Critères de réussite définis et mesurables
Enabler 1 donne le coup d'envoi de notre série en 10 parties intitulée Enablers of Success en montrant comment associer le codage sécurisé à des résultats commerciaux tels que la réduction des risques et la rapidité pour assurer la maturité à long terme des programmes.
