Calvin, a grey-hat hacker, targets a web application that has design flaws in its authentication...

Verbose failure messages are detailed error messages that reveal too much information about authentication failures. In the described scenario, the web application specifies whether the username or password is incorrect. This behavior enables attackers to:

Enumerate valid usernames by submitting random inputs and observing which error message is returned.

Use the valid usernames to conduct targeted attacks such as brute-force attempts or social engineering.

According to CEH v13:

Authentication mechanisms should provide generic error messages such as “Invalid username or password” to avoid exposing system behavior.

Verbose error messages violate the principle of "fail securely."

Incorrect Options:

A. Insecure transmission relates to credentials being sent over unencrypted channels (e.g., HTTP instead of HTTPS).

C. User impersonation involves taking on the identity of another user, not enumeration.

D. Password reset mechanisms are a different component of authentication, not mentioned in this context.

Reference – CEH v13 Official Courseware:

Module 14: Hacking Web Applications

Section: “Authentication Bypass Techniques”

Subsection: “Enumeration via Verbose Error Messages”

===========