Enumeration Security Risks

Overview

Computers love sequences and we love making computers do our work for us, so it

should be no surprise that enumeration can happen very easily when we're being

lazy. If you are relying on database sequence identifiers to locate objects in

APIs, whether internal or external, you open the door to enumeration attacks

where malicious agents with knowledge of the sequence can quickly scan for other

resources that may or may not exist.

In fact, the non-existence of a new resource in a sequence can be as harmful

as them finding the next item, as it can open the door to unexpected errors or

messages.