The first step to defeating a common user/password authentication mechanism is to discover valid usernames. One way of doing this is by enumeration; enumerating users in web applications is done by analyzing the responses when usernames are submitted in places such as login, registration, and password recovery pages.
In this recipe, we will use a list of common usernames to submit multiple requests to an application and figure out which of the submitted names belongs to an existing user by comparing the responses.
