Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-idnt-04
Test Account Enumeration
Passed 20 of 22 test cases with the skill, and 20 of 22 without it.
1 fixed19 passed either way1 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
A test case the skill fixed. Same model, same prompt, with and without the skill.
At what point in the login workflow should a modern web application trigger CAPTCHA challenges to mitigate credential enumeration without degrading initial user experience?
| Checked | Without skill | With skill |
|---|---|---|
| Recommends presenting CAPTCHA challenges after a threshold of failed attempt count is reached | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-IDNT-04
Testing for Account Enumeration and Guessable User Account
Account enumeration occurs when an application reveals whether a username or email exists in the system through different response messages, timing differences, or HTTP status codes. Attackers use this information to compile valid account lists for targeted attacks such as brute-force, credential stuffing, or phishing. This test identifies enumeration vulnerabilities across all authentication-related endpoints.
| Location | Enumeration Sign |
|---|---|
| Login | "Invalid username" vs "Invalid password" |
| Registration | "Username already exists" |
| Password Reset | "Email sent" vs "User not found" |
| API | Different status codes (404 vs 401) |
| Timing | Faster response for non-existent users |
test cases passed, vs 20 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.