wstg-identity-management

Account enumeration testing compares application responses across three scenarios: valid username with valid password, valid username with invalid password, and invalid username. Differences in error messages, status codes, response lengths, page titles, or timing reveal valid accounts.

Test RBAC by identifying all roles, then manipulating role-bearing parameters in cookies, JWTs, and hidden fields to attempt unauthorized role switching. Use two concurrent sessions with different privilege levels to diff accessible endpoints and detect missing server-side authorization checks.

WSTG v4.2 Identity Management Testing covers five areas: role definitions (IDNT-01), user registration (IDNT-02), account provisioning (IDNT-03), account enumeration and guessable accounts (IDNT-04), and weak username policies (IDNT-05).

Yes, timing side channels reveal valid usernames when the application performs extra backend work only for existing accounts, such as database lookups or email dispatch in password reset flows. A delay exceeding roughly 100ms between valid and invalid inputs is a reliable enumeration signal.

De-provisioning testing verifies that disabled accounts lose all access, including active sessions, API keys, and JWTs. Many applications disable the account record but fail to revoke existing tokens, leaving backdoor access paths and orphaned resources.