Test for user enumeration vulnerabilities through various authentication endpoints.

User Enumeration Audit 🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED You MUST write to context files AS YOU GO , not just at the end. Write to .sb pentest context.json IMMEDIATELY after each endpoint tested Log to .sb pentest audit.log BEFORE and AFTER each test DO NOT wait until the skill completes to update files If the skill crashes or is interrupted, all prior findings must already be saved This is not optional. Failure to write progressively is a critical error. This skill tests for user enumeration vulnerabilities in authentication flows. When to Use This Skill To check if user existence can be detected To test login, signup, and recovery flows for information leakage As part of authentication security audit Before production deployment Prerequisites Supabase URL and anon key available Auth endpoints accessible What is User Enumeration? User enumeration occurs when an application reveals whether a user account exists through: Vector Indicator Different error messages "User not found" vs "Wrong password" Response timing Fast for non existent, slow for existing Response codes 404 vs 401 Signup response "Email already registered" Why It Matters Risk Impact Targeted attacks Attackers know valid accounts Phishing Confirm targets have accounts Credential stuffing Reduce attack scope Privacy Reveal user presence Tests Performed Endpoint Test Method /auth/v1/signup Try registering existing email /auth/v1/token Try login with various emails /auth/v1/recover Try password reset /auth/v1/otp Try OTP for various emails Usage Basic Enumeration Test Test Specific Endpoint Output Format bash curl X POST https://abc123def.supabase.co/auth/v1/signup \ H "apikey: [anon key]" \ H "Content Type: application/json" \ d '{"email": "target@example.com", "password": "test123"}' If user exists: {"msg": "User already registered"} If new user: User created or confirmation needed python import requests import time def check user(email): start = time.time() requests.post( 'https://abc123def.supabase.co/auth/v1/token', params={'grant type': 'password'}, json={'email': email, 'password': 'wrong'}, headers={'apikey': '[anon key]'} ) elapsed = time.time() start return elapsed 0.15 Threshold exists = check user('target@example.com') typescript const MIN RESPONSE TIME = 1000; // 1 second const start = Date.now(); // ... perform auth operation ... const elapsed = Date.now() start; await new Promise(r = setTimeout(r, Math.max(0, MIN RESPONSE TIME elapsed) )); return response; Timing Analysis The skill measures response times to detect timing based enumeration: Threshold detection: Difference 100ms: Possible timing leak Difference 500ms: Definite timing leak Context Output Mitigation Code Examples Consistent Response Time Generic Error Messages MANDATORY: Progressive Context File Updates ⚠️ This skill MUST update tracking files PROGRESSIVELY during execution, NOT just at the end. Critical Rule: Write As You Go DO NOT batch all writes at the end. Instead: 1. Before testing each endpoint → Log the action to .sb pentest audit.log 2. After each timing measurement → Immediately update .sb pentest context.json 3. After each enumeration vector found → Log the finding immediately This ensures that if the skill is interrupted, crashes, or times out, all findings up to that point are preserved. Required Actions (Progressive) 1. Update .sb pentest context.json with results: 2. Log to .sb pentest audit.log : 3. If files don't exist , create them before writing. FAILURE TO UPDATE CONTEXT FILES IS NOT ACCEPTABLE. MANDATORY: Evidence Collection 📁 Evidence Directory: .sb pentest evidence/05 auth audit/enumeration tests/ Evidence Files to Create File Content enumeration tests/login timing.json Login endpoint timing analysis enumeration tests/recovery timing.json Recovery endpoint timing enumeration tests/otp enumeration.json OTP endpoint message analysis Evidence Format Related Skills supabase audit auth config — Full auth configuration supabase audit auth signup — Signup flow testing supabase report — Include in final report

supabase-audit-auth-users