Faces in the Fog: Identifying Users through Unconventional Means

This talk demonstrates how to identify and enumerate users in web applications by analyzing unconventional indicators such as error messages, response timing, and application-specific logic. It explores how developers often inadvertently leak sensitive user information through insecure API endpoints, password reset flows, and account management features. The speaker provides a practical methodology for using LLMs to automate the analysis of HTTP traffic to identify these enumeration vulnerabilities. A custom Python script is demonstrated to automate the extraction of user data from application responses.