312-50 Question 316
Single answer▪ Attack Authentication MechanismDuring an internal CEH-authorized assessment, you discover that a legacy web application uses a custom login process over HTTPS. The application returns different error messages for invalid usernames and invalid passwords, and testing shows there is no account lockout after repeated failures. The client asks which issue most directly increases the risk of a password attack against the authentication mechanism and should be prioritized for remediation first.
- A
The application uses HTTPS for the login form, which allows credentials to be captured in transit more easily
- B
The authentication system reveals whether a username is valid, enabling user enumeration before password guessing
- C
The login page is hosted on a non-standard TCP port, making authentication bypass more likely
- D
The application uses session cookies after login, which means password cracking can occur without interacting with the login form
Show answer and explanation
Correct answer: B
Explanation
The best answer is the user enumeration weakness. In real-world attacks against authentication mechanisms, attackers commonly combine username discovery with password spraying, credential stuffing, or targeted brute-force attempts. When an application reveals whether a username is valid, it removes uncertainty and reduces noise in the attack. The absence of account lockout, throttling, or other rate-limiting controls further amplifies the risk, but the question asks which issue most directly increases the effectiveness of the password attack itself in this scenario. Industry guidance such as the OWASP Authentication Cheat Sheet recommends using generic authentication error messages, implementing rate limiting, and protecting against automated login attempts. NIST guidance in SP 800-63 also supports limiting online guessing and avoiding mechanisms that leak unnecessary identity information during authentication.
- A. Incorrect.
Incorrect. HTTPS is intended to protect credentials in transit by encrypting the connection. While HTTPS does not stop online brute-force or credential stuffing attacks, it does not make credential capture easier; the opposite is true when it is properly implemented.
- B. Correct.
Correct. Distinct error messages such as 'user does not exist' versus 'incorrect password' enable user enumeration. In combination with the lack of account lockout or rate limiting, this significantly improves the efficiency of password attacks because an attacker can first identify valid usernames and then focus password guessing only on real accounts.
- C. Incorrect.
Incorrect. Running a login service on a non-standard port does not inherently increase the likelihood of authentication bypass. Attackers can discover open ports through scanning, and port number choice is not a meaningful control against password attacks.
- D. Incorrect.
Incorrect. Session cookies are a normal part of maintaining authenticated state after login. Their existence does not mean passwords can be cracked without interacting with the authentication process. Cookie theft or session hijacking is a different attack class from attacking the password-based authentication mechanism itself.