Enumeration Attack

Key takeaways

• 

  To prevent enumeration attacks, web forms should never indicate the validity of submitted fields. Instead, an incorrect submission should simply let the user know that either the submitted username or password was incorrect.
• 

  Server response times could also indicate the validity of submitted records. Web servers commonly take longer to respond to incorrect submissions.
• 

  Limiting login attempts will mitigate brute force attacks, and therefore, enumeration attacks.
• 
•