spec 1 linked patterns checked
OWASP WSTG account enumeration testing
Documents testing registration, login, and recovery flows for account enumeration through different messages, redirects, response bodies, response times, and user-specific URLs.
Read with a purpose
What this source can teach
Use this source to check a technical or accessibility requirement against its exact wording and scope.
- Start with the original. Open the source and find the guidance or example relevant to your task.
- Trace the connection. Use the claim notes below to see how this site applies the source to specific patterns.
- Check the setting. Compare the source's platform, people, and constraints with your own decision.
Pattern Decisions This Source Supports
| Pattern | Supported decision | Required contract | Claim note |
|---|---|---|---|
| Account creation | Choose account creation when a persistent account is required for repeated access, saved data, account management, security, authorization, legal accountability, or returning to drafts. | The flow states why the account is needed before asking for credentials. | OWASP WSTG supports testing registration and recovery flows for account-enumeration signals. |
Comparisons supported by this source
- Account creation vs start page vs onboarding vs password creation
OWASP WSTG supports checking registration, login, and recovery flows for discrepant account-existence signals.
Evidence Role
This source is treated as spec evidence. Its value comes from the specific claims and setting described above.
Publisher: OWASP Web Security Testing Guide. Last checked: .