What is Account Enumeration?

Account enumeration is the discovery of valid usernames, email addresses or accounts through differences in application behavior. Login, registration, password reset and support flows may reveal existence through text, status code, response size, redirects, side effects or timing.

The information does not itself take over an account, but it improves brute force, credential stuffing and targeted phishing. For sensitive services, membership alone may be confidential.

What signals reveal an account?

• Explicit messages:
  “User not found” versus “Wrong password”.
• HTTP behavior:
  Different codes, redirects, headers or body sizes.
• Timing:
  Only an existing account triggers a password hash or external identity lookup.
• Side effects:
  Reset mail, MFA, CAPTCHA or lockout occurs only for valid accounts.

Code example: revealing and neutral responses

Vulnerable:

$user = User::where('email', $request->email)->first();

if (!$user) {
    return response()->json(['error' => 'Account does not exist'], 404);
}

if (!Hash::check($request->password, $user->password)) {
    return response()->json(['error' => 'Wrong password'], 401);
}

Better: same external response and comparable work.

$user = User::where('email', $request->email)->first();
$hash = $user?->password ?? config('security.dummy_password_hash');
$valid = Hash::check($request->password, $hash);

if (!$user || !$valid) {
    return response()->json(['error' => 'Invalid credentials'], 401);
}

A precomputed dummy hash avoids skipping expensive verification for unknown users. Random delays alone are weak and can be averaged out.

Protecting login and reset flows

• - Return the same neutral message, status and comparable flow for all outcomes.
• - For reset, always say that a message was sent if the account exists.
• - Combine account, IP, device and risk-based rate limits; consider distributed requests.
• - Detect suspicious series without enabling denial of service through easy account lockout.
• - Use MFA and strong passwords to limit impact; they do not fix enumeration itself.

Testing and open-source tools

Compare a known account with several definitely absent values across messages, codes, headers, sizes, redirects and repeated timing measurements. Use only controlled accounts to avoid lockout or email floods. OWASP ZAP records and compares responses; ffuf can vary identifiers and filter by size, words or status. Results require manual confirmation because subtle business and timing differences create false positives.