Performing user enumeration through noisy authentication controls
Enumeration allows both ethical hackers and penetration testers to gather specific information from their target systems, such as user accounts, system information, network connections, running processes, and more. Using the information that's been collected from enumeration allows a penetration tester to perform techniques to compromise the target.
As many organizations are using cloud-based email solutions such as Office 365 and Google Workspace for their employees, they are also synchronizing their Active Directory user database with the email services of their preferred cloud-based email provider. This means that an employee's login username is the same as the username portion of their email address.
To gain a better understanding of this, let's take a look at the following global login page for Office 365 users:
Figure 5.55 – Office 365 login page
As shown in...
