Collected research

Enumerating logins via Abuse of Functionality vulnerabilities

Виявлення логінів через Abuse of Functionality уразливості - Websecurity

Reports that the username-availability checkers on large sites are an abuse-of-functionality flaw that leaks valid logins. On YouTube's signup form the Check Availability AJAX response distinguishes existing from free names, and with no anti-automation the check can be brute-forced over a wordlist to build a list of real accounts for password attacks.

Record

Document

Виявлення логінів через Abuse of Functionality уразливості - Websecurity

Published by

websecurity.com.ua

Topic

Other

In the archive

• Collected in the 2009 research round

Tags

• info-leak
• detection
• tooling
• case-study
• user-enumeration
• abuse-of-functionality
• owasp-a04-2021
• owasp-a09-2021

This page is the archive's own catalogue record. The research is the work of websecurity.com.ua, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.