4 ms·
You're correct, it's not enumeration, but it's easier than pure brute force. As the article itself suggests, if the company does use a predictable user name for
by teractiveodular 2y ago
You're correct, it's not enumeration, but it's easier than pure brute force. As the article itself suggests, if the company does use a predictable user name format (and most do), it's pretty trivial to look up their employees on LinkedIn, create a list of likely usernames, and then check if they exist.
- g15jv2dp 2y agoAnd then what?
- teractiveodular 2y agoSend targeted phishing mails.
- vasco 2y agoI can already do that by sending them for root. This seems like trying to make something out of nothing.
- teractiveodular 2y agoAre you stuck in the 70s or something? I can't recall the last time I read email addressed to root.
- vasco 2y agoMy friend, the main AWS account is called the root account and its username is root, so your zinger didn't zing.
- ramon156 2y agoOur company got hit with this. I guess there's no way to recover from this other than do our best to block these.
- g15jv2dp 2y agoHow does knowing the AWS username allow you to send a more effective phishing email? Especially if the username is just the user's... name. That's public info.
- metadat 2y agoA.k.a. .. enumeration.
- teractiveodular 2y agoNo, enumeration would be if you can get the entire list of usernames somehow.
- metadat 2y ago> No, enumeration would be if you can get the entire list of usernames somehow. It's still a form of enumeration. Once you know the generation scheme, you can always enumerate some form, perfect or otherwise.
- jadengeller 2y agoIf there are rate limits, or if the search space is vast, this is notably more limited (even if arguably still enumeration)
- vasco 2y agoEnumeration means a specific thing, that you get a full or paginated list of things and all you need to do is hit it. This isn't enumeration at all. It's like you saying you know the bucket keys to a hashtable so you can enumerate it by hitting them one by one, except in this case you don't even know the keys.