Found a ADFS User Enumeration Timing Attack.https://github.com/binary1985/VulnerabilityDisclosure/blob/master/ADFS-Timing-Attack …
Hmm, I remember finding an url where a valid username vs not valid gave two different integers in the response... I assumed it was by design?
-
-
You mean the response code from the Office365 login?
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.