Home / Knowledge hub / Enumeration
Knowledge hub
Enumeration
Working out what exists by asking repeatedly and watching the answers.
What it means
Enumeration means working out what exists by asking over and over. Which email addresses are registered, which record numbers are valid, which screens a role can open, which endpoints an API really has.
Applications give this away through small differences between answers. No account with that email, against wrong password. A missing record answered differently from one you simply may not see. A reply that arrives faster because the work stopped earlier. MITRE files this under observable response discrepancy.
Why it matters
On its own it steals nothing, which is why teams dismiss it. Its value is as the step before the attack. A confirmed list of real accounts makes credential stuffing worth running. A confirmed range of valid record numbers makes an IDOR immediately useful.
Think about what your product confirms simply by existing. A signup form that rejects a duplicate email confirms membership. Sequential invoice numbers hint at how many customers you have. Some of that is unavoidable and some of it is a decision nobody made deliberately. Telling the two apart is most of the work.
How it shows up
Check every place that answers a question about existence: login, password reset, signup, invitations, and anything that takes an identifier. Compare the reply for something that does not exist against the reply for something that exists but is not yours. Compare the status code, the body and the timing.
OWASP's advice is to make both cases answer identically, then limit the endpoint so asking repeatedly gets expensive. PortSwigger's academy shows how attackers read the differences, including response time.
Questions people ask
Enumeration, answered
Is user enumeration actually a vulnerability, or is it just noise?
It is a real finding, usually rated low to medium, and it is genuinely less urgent than a missing permission check.
The reason to fix it is what it enables. Once somebody holds a verified list of your users, every password attack becomes cheaper and more targeted.
How do we hide it on password reset without confusing real users?
Always reply with the same message, along the lines of if that address has an account, we have sent a link. Then send an email either way, including one telling an unregistered address that somebody tried.
Users cope with this fine. It has been the standard pattern for years.
Our signup form already rejects duplicate emails. Have we not lost anyway?
Partly, and this is a fair objection. Registration flows leak membership by design unless you move the check into an emailed confirmation step.
Fix the endpoints an attacker can hammer cheaply first: login, reset and any API that takes an identifier. Perfect secrecy is not the goal. Making bulk checking slow and unreliable is.
Do sequential ids matter if we check permissions properly?
With authorisation correct on every request, sequential ids are mostly a privacy detail. They still tell a competitor how many orders you take in a month.
Unpredictable ids are worth having as a second layer. They are not a substitute for the check, and treating them as one is how teams end up with an IDOR.
Will a bug bounty programme pay for an enumeration report?
Often not much, and many programmes list it as out of scope or informational. That reflects payout policy rather than whether it is real.
Chained with a weak password policy or a missing rate limit, the same finding gets taken seriously, because then it leads somewhere.
Related
Terms that sit next to this one
Credential stuffing
Trying passwords leaked elsewhere, because people reuse them.
Brute force
Trying passwords or codes over and over until one of them works.
Rate limiting
Capping how often something can be attempted, per user or per address.
IDOR
Changing an id in a request and getting back someone else's record.
Attack surface
Everything about your application an outsider can touch.
Does your login confirm real accounts?
We compare the replies your application gives for what does not exist, what does, and what you may not see, then report every difference with evidence. Get in touch about scope.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.