GIAC Foundational Cybersecurity Technologies Practice Test

What attack does the command indicated below attempt?

1. Dictionary attack against known user accounts on a website

2. Dictionary attack against unknown user accounts on a website

3. Search for valid accounts using a wordlist against a website

4. Search for directories not linked to public areas of a website

The correct answer is: Search for valid accounts using a wordlist against a website

The command in question is attempting to search for valid accounts by using a wordlist against a website. This technique, commonly known as a credential stuffing or account enumeration attack, involves systematically testing multiple potential usernames or account identifiers from a predetermined list. The attacker seeks to identify which of these usernames are associated with valid accounts. When conducting this type of attack, the attacker leverages a wordlist that contains likely usernames, which can be derived from common names, previous data breaches, or variations of known usernames. The primary goal here is not just to find any accounts but to pinpoint which usernames are valid on the target website, which could then be exploited for unauthorized access or further attacks. This method contrasts with other types of attacks that focus on either known user accounts or those that aim to discover undisclosed directories or files on a web server. The key distinction is that this approach specifically targets the validation of accounts using a list, making it a focused reconnaissance effort to map out existing accounts.