loginscan 0.1.0__tar.gz

loginscan-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ulku Bayraktar
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

loginscan-0.1.0/PKG-INFO

@@ -0,0 +1,165 @@
+Metadata-Version: 2.4
+Name: loginscan
+Version: 0.1.0
+Summary: Kendi login endpoint'inizi savunma amaçlı tarayan, bağımlılıksız güvenlik aracı.
+Author: Ulku Bayraktar
+License: MIT License
+        
+        Copyright (c) 2026 Ulku Bayraktar
+        
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to deal
+        in the Software without restriction, including without limitation the rights
+        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+        
+        The above copyright notice and this permission notice shall be included in all
+        copies or substantial portions of the Software.
+        
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE.
+        
+Project-URL: Homepage, https://github.com/ulkubayraktar/loginscan
+Keywords: security,login,authentication,self-audit,sql-injection,defensive
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Topic :: Security
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: dev
+Requires-Dist: pytest>=7; extra == "dev"
+Dynamic: license-file
+
+# loginscan
+
+A lightweight, dependency-free **defensive self-audit scanner** for login endpoints.
+Point it at your own login page or API, and it runs a series of **safe, low-volume**
+checks and reports what is wrong and **how to fix it**. You can scan by giving just a
+**site link** or a **Swagger/OpenAPI link** — the login endpoint is auto-discovered.
+
+> ⚠️ **Authorized use only.** Run this only against systems you **own** or have **written
+> permission** to test. Unauthorized scanning is illegal. The tool refuses to run without
+> an explicit confirmation (`--i-own-this` / `authorized=True`).
+
+## Why it's safe
+
+This is not an attack tool. By design it:
+
+- **Does not crack passwords** — no brute-force, no wordlists. The "brute-force" check only
+  sends 5–6 requests to see *whether rate limiting exists*.
+- **Is low-volume** — a total request budget (default 25) caps every scan.
+- **Is non-destructive** — only well-known detection probes; it never modifies data.
+
+## Install
+
+```bash
+pip install .
+# or, for development:
+pip install -e .
+```
+
+## Usage
+
+Scan by explicit URL:
+
+```bash
+loginscan https://site/login --i-own-this --user alice --success "Welcome"
+```
+
+Scan by **site link** (login form auto-discovered):
+
+```bash
+loginscan --site https://site/login-page --i-own-this --user alice
+```
+
+Scan by **Swagger/OpenAPI link** (JSON spec; endpoint + fields auto-discovered):
+
+```bash
+loginscan --swagger https://api.site/openapi.json --i-own-this --user alice
+```
+
+Useful options:
+
+| Option | Description |
+|---|---|
+| `--i-own-this` | **Required.** Asserts you are authorized to test the target. |
+| `--user NAME` | A username that really exists (not the password). Strengthens the enumeration check. |
+| `--success "text"` | Text that means "login succeeded". Repeatable. |
+| `--json-body` | Send credentials as JSON instead of form-encoded. |
+| `--username-field` / `--password-field` | Override field names. |
+| `--field csrf=abc` | Constant field added to every request. |
+| `--max-requests 25` | Total request budget. |
+| `--json report.json` | Also write the report as JSON. |
+| `--html report.html` | Also write a shareable, styled HTML report. |
+| `--insecure` | Disable TLS verification (for your own test server). |
+
+Exit code: `1` if any vulnerability is found, `0` if clean, `2` if unauthorized/misused (handy for CI).
+
+## Python API
+
+```python
+from loginscan import Scanner, ScanConfig
+
+cfg = ScanConfig(url="https://site/login", known_username="alice",
+                 success_indicators=["Welcome"])
+report = Scanner(cfg, authorized=True).run()
+print(report.to_text())
+print(report.to_json())
+```
+
+## Checks
+
+| Check | What it looks for |
+|---|---|
+| `sqli` | SQL-injection auth bypass + database error leakage |
+| `enumeration` | Different responses for existing vs unknown users |
+| `ratelimit` | Whether repeated failed logins get blocked |
+| `cookies` | Session cookie HttpOnly / Secure / SameSite flags |
+| `session` | Predictable session tokens (short / numeric / sequential / low-entropy) |
+| `csrf` | CSRF token / cookie / SameSite defense on the login page |
+| `open_redirect` | Unvalidated redirect via `?next=`, `?returnUrl=`, etc. |
+| `jwt` | Passive JWT weaknesses (`alg=none`, missing `exp`) |
+| `headers` | HTTPS, HSTS, nosniff, clickjacking, Referrer-Policy, version disclosure |
+
+## Roadmap (checks to add next, in order)
+
+- [ ] `verb` — HTTP method handling / verb tampering
+- [ ] `cors` — permissive CORS on the auth endpoint (`ACAO: *` with credentials)
+- [ ] `cache` — sensitive responses missing `Cache-Control: no-store`
+
+## Learning demo
+
+This repo also ships an intentionally **vulnerable** and a **secure** server to try loginscan against:
+
+```bash
+python3 vulnerable_app.py     # terminal 1 -> port 8001
+loginscan --site http://127.0.0.1:8001/ --i-own-this --user admin --success "Giriş başarılı"
+#   -> 4 vulnerabilities found
+
+python3 secure_app.py         # port 8002
+loginscan --site http://127.0.0.1:8002/ --i-own-this --user admin --success "Giriş başarılı"
+#   -> sqli / enumeration / rate-limit all OK
+```
+
+## Releasing to PyPI
+
+The package builds cleanly (`python -m build`) and passes `twine check`. To publish:
+
+1. Create the `loginscan` project on PyPI and add a Trusted Publisher for this repo's
+   `Publish to PyPI` workflow (environment `pypi`).
+2. Push a version tag: `git tag v0.1.0 && git push origin v0.1.0`.
+
+The workflow then builds and uploads automatically — no API token stored in the repo.
+
+## License
+
+MIT. Authorized use only.

loginscan-0.1.0/README.md

@@ -0,0 +1,124 @@
+# loginscan
+
+A lightweight, dependency-free **defensive self-audit scanner** for login endpoints.
+Point it at your own login page or API, and it runs a series of **safe, low-volume**
+checks and reports what is wrong and **how to fix it**. You can scan by giving just a
+**site link** or a **Swagger/OpenAPI link** — the login endpoint is auto-discovered.
+
+> ⚠️ **Authorized use only.** Run this only against systems you **own** or have **written
+> permission** to test. Unauthorized scanning is illegal. The tool refuses to run without
+> an explicit confirmation (`--i-own-this` / `authorized=True`).
+
+## Why it's safe
+
+This is not an attack tool. By design it:
+
+- **Does not crack passwords** — no brute-force, no wordlists. The "brute-force" check only
+  sends 5–6 requests to see *whether rate limiting exists*.
+- **Is low-volume** — a total request budget (default 25) caps every scan.
+- **Is non-destructive** — only well-known detection probes; it never modifies data.
+
+## Install
+
+```bash
+pip install .
+# or, for development:
+pip install -e .
+```
+
+## Usage
+
+Scan by explicit URL:
+
+```bash
+loginscan https://site/login --i-own-this --user alice --success "Welcome"
+```
+
+Scan by **site link** (login form auto-discovered):
+
+```bash
+loginscan --site https://site/login-page --i-own-this --user alice
+```
+
+Scan by **Swagger/OpenAPI link** (JSON spec; endpoint + fields auto-discovered):
+
+```bash
+loginscan --swagger https://api.site/openapi.json --i-own-this --user alice
+```
+
+Useful options:
+
+| Option | Description |
+|---|---|
+| `--i-own-this` | **Required.** Asserts you are authorized to test the target. |
+| `--user NAME` | A username that really exists (not the password). Strengthens the enumeration check. |
+| `--success "text"` | Text that means "login succeeded". Repeatable. |
+| `--json-body` | Send credentials as JSON instead of form-encoded. |
+| `--username-field` / `--password-field` | Override field names. |
+| `--field csrf=abc` | Constant field added to every request. |
+| `--max-requests 25` | Total request budget. |
+| `--json report.json` | Also write the report as JSON. |
+| `--html report.html` | Also write a shareable, styled HTML report. |
+| `--insecure` | Disable TLS verification (for your own test server). |
+
+Exit code: `1` if any vulnerability is found, `0` if clean, `2` if unauthorized/misused (handy for CI).
+
+## Python API
+
+```python
+from loginscan import Scanner, ScanConfig
+
+cfg = ScanConfig(url="https://site/login", known_username="alice",
+                 success_indicators=["Welcome"])
+report = Scanner(cfg, authorized=True).run()
+print(report.to_text())
+print(report.to_json())
+```
+
+## Checks
+
+| Check | What it looks for |
+|---|---|
+| `sqli` | SQL-injection auth bypass + database error leakage |
+| `enumeration` | Different responses for existing vs unknown users |
+| `ratelimit` | Whether repeated failed logins get blocked |
+| `cookies` | Session cookie HttpOnly / Secure / SameSite flags |
+| `session` | Predictable session tokens (short / numeric / sequential / low-entropy) |
+| `csrf` | CSRF token / cookie / SameSite defense on the login page |
+| `open_redirect` | Unvalidated redirect via `?next=`, `?returnUrl=`, etc. |
+| `jwt` | Passive JWT weaknesses (`alg=none`, missing `exp`) |
+| `headers` | HTTPS, HSTS, nosniff, clickjacking, Referrer-Policy, version disclosure |
+
+## Roadmap (checks to add next, in order)
+
+- [ ] `verb` — HTTP method handling / verb tampering
+- [ ] `cors` — permissive CORS on the auth endpoint (`ACAO: *` with credentials)
+- [ ] `cache` — sensitive responses missing `Cache-Control: no-store`
+
+## Learning demo
+
+This repo also ships an intentionally **vulnerable** and a **secure** server to try loginscan against:
+
+```bash
+python3 vulnerable_app.py     # terminal 1 -> port 8001
+loginscan --site http://127.0.0.1:8001/ --i-own-this --user admin --success "Giriş başarılı"
+#   -> 4 vulnerabilities found
+
+python3 secure_app.py         # port 8002
+loginscan --site http://127.0.0.1:8002/ --i-own-this --user admin --success "Giriş başarılı"
+#   -> sqli / enumeration / rate-limit all OK
+```
+
+## Releasing to PyPI
+
+The package builds cleanly (`python -m build`) and passes `twine check`. To publish:
+
+1. Create the `loginscan` project on PyPI and add a Trusted Publisher for this repo's
+   `Publish to PyPI` workflow (environment `pypi`).
+2. Push a version tag: `git tag v0.1.0 && git push origin v0.1.0`.
+
+The workflow then builds and uploads automatically — no API token stored in the repo.
+
+## License
+
+MIT. Authorized use only.

loginscan-0.1.0/loginscan/__init__.py

@@ -0,0 +1,17 @@
+"""loginscan - a lightweight, dependency-free self-audit scanner for login endpoints.
+
+Only use it against systems you own or are authorized to test. It does not crack
+passwords and runs low-volume; the goal is to detect issues and suggest fixes.
+"""
+from .authorization import AUTHORIZATION_NOTICE, NotAuthorized
+from .models import Finding, ScanConfig, Severity, Status
+from .report import Report
+from .scanner import Scanner
+
+__version__ = "0.1.0"
+
+__all__ = [
+    "Scanner", "ScanConfig", "Report", "Finding",
+    "Severity", "Status", "NotAuthorized", "AUTHORIZATION_NOTICE",
+    "__version__",
+]

loginscan-0.1.0/loginscan/authorization.py

@@ -0,0 +1,22 @@
+"""Authorization gate. Only scan systems you own or are permitted to test."""
+from __future__ import annotations
+
+AUTHORIZATION_NOTICE = (
+    "WARNING: loginscan must only be used against systems you own or have written\n"
+    "permission to test. Unauthorized scanning is illegal and unethical. By scanning,\n"
+    "you assert that you are authorized to test the target."
+)
+
+
+class NotAuthorized(Exception):
+    pass
+
+
+def ensure_authorized(authorized: bool) -> None:
+    if not authorized:
+        raise NotAuthorized(
+            "Scan refused: authorization not confirmed.\n\n"
+            + AUTHORIZATION_NOTICE
+            + "\n\nPython API: Scanner(config, authorized=True)\n"
+            "CLI:        add the --i-own-this flag."
+        )

loginscan-0.1.0/loginscan/checks/__init__.py

@@ -0,0 +1,11 @@
+"""Check modules. Each exposes run(client, cfg) -> List[Finding]."""
+from . import (cookies, csrf, enumeration, headers, jwt, open_redirect,
+               ratelimit, session, sqli)
+
+# enumeration runs before sqli so sqli's many failed logins don't trip the
+# target's rate limiter and pollute the enumeration measurement.
+ALL_CHECKS = [headers, csrf, open_redirect, enumeration, sqli, cookies,
+              session, jwt, ratelimit]
+
+__all__ = ["ALL_CHECKS", "sqli", "enumeration", "ratelimit", "cookies", "session",
+           "headers", "csrf", "jwt", "open_redirect"]

loginscan-0.1.0/loginscan/checks/base.py

@@ -0,0 +1,77 @@
+"""Shared helpers: build login data, get a baseline failed login, guess success."""
+from __future__ import annotations
+
+import re
+import secrets
+from typing import Dict, List, Optional
+
+from ..http import HttpClient, Response
+from ..models import ScanConfig
+
+SQL_ERROR_SIGNS = [
+    "sql syntax", "sqlite3.", "sqlite error", "psycopg2", "pg::",
+    "mysql_fetch", "you have an error in your sql",
+    "unclosed quotation mark", "quoted string not properly terminated",
+    "odbc", "ora-0", "syntax error", "sqlalchemy",
+]
+
+SESSION_COOKIE_HINT = re.compile(r"sess|token|auth|sid|jwt|login", re.I)
+
+
+def random_username(prefix: str = "nouser") -> str:
+    return f"{prefix}_{secrets.token_hex(4)}"
+
+
+def build_data(cfg: ScanConfig, username: str, password: str) -> Dict[str, str]:
+    data = dict(cfg.extra_fields)
+    data[cfg.username_field] = username
+    data[cfg.password_field] = password
+    return data
+
+
+def submit_login(client: HttpClient, cfg: ScanConfig, username: str, password: str) -> Response:
+    return client.request(cfg.method, cfg.url, data=build_data(cfg, username, password),
+                          content_type=cfg.content_type)
+
+
+def cookie_names(resp: Response) -> List[str]:
+    return [c.split("=", 1)[0].strip() for c in resp.set_cookies if c.split("=", 1)[0].strip()]
+
+
+def session_cookies(resp: Response) -> List[str]:
+    return [n for n in cookie_names(resp) if SESSION_COOKIE_HINT.search(n)]
+
+
+def baseline_fail(client: HttpClient, cfg: ScanConfig) -> Response:
+    return submit_login(client, cfg, random_username(), "wrong_" + secrets.token_hex(3))
+
+
+def has_sql_error(body: str) -> Optional[str]:
+    low = body.lower()
+    for sign in SQL_ERROR_SIGNS:
+        if sign in low:
+            return sign
+    return None
+
+
+def looks_like_success(resp: Response, baseline: Response, cfg: ScanConfig) -> Optional[str]:
+    """Return a reason string if resp looks like a successful login, else None.
+
+    Conservative on purpose to limit false positives; evidence goes in the report.
+    """
+    for token in cfg.success_indicators:
+        if token and token.lower() in resp.body.lower():
+            return f"success text seen in response: '{token}'"
+
+    new_sess = set(session_cookies(resp)) - set(session_cookies(baseline))
+    if new_sess:
+        return f"session cookie set that the failed baseline did not get: {sorted(new_sess)}"
+
+    if resp.status < 400 and baseline.status >= 400:
+        return f"status upgraded vs failed baseline (HTTP {resp.status} vs {baseline.status})"
+
+    if 300 <= resp.status < 400 and not (300 <= baseline.status < 400):
+        loc = resp.header("location") or "?"
+        return f"redirect not present in failed baseline (HTTP {resp.status} -> {loc})"
+
+    return None

loginscan-0.1.0/loginscan/checks/cookies.py

@@ -0,0 +1,61 @@
+"""Session cookie flag check: HttpOnly, Secure, SameSite."""
+from __future__ import annotations
+
+from typing import List
+from urllib.parse import urlparse
+
+from ..http import HttpClient
+from ..models import Finding, ScanConfig, Severity, Status
+from .base import baseline_fail
+
+CHECK = "cookies"
+
+
+def _parse_flags(raw: str) -> dict:
+    name = raw.split("=", 1)[0].strip() if raw else "?"
+    low = raw.lower()
+    return {
+        "name": name,
+        "httponly": "httponly" in low,
+        "secure": "secure" in low,
+        "samesite": "samesite" in low,
+    }
+
+
+def run(client: HttpClient, cfg: ScanConfig) -> List[Finding]:
+    resp = baseline_fail(client, cfg)
+    is_https = urlparse(cfg.url).scheme == "https"
+
+    if not resp.set_cookies:
+        return [Finding(
+            check=CHECK, status=Status.SKIPPED, severity=Severity.INFO,
+            title="No cookies to inspect",
+            detail="No Set-Cookie on this request (session may be set only on successful login).",
+        )]
+
+    findings: List[Finding] = []
+    for raw in resp.set_cookies:
+        f = _parse_flags(raw)
+        missing = []
+        if not f["httponly"]:
+            missing.append("HttpOnly")
+        if is_https and not f["secure"]:
+            missing.append("Secure")
+        if not f["samesite"]:
+            missing.append("SameSite")
+
+        if missing:
+            findings.append(Finding(
+                check=CHECK, status=Status.VULNERABLE, severity=Severity.MEDIUM,
+                title=f"Cookie missing security flags: {f['name']}",
+                detail=f"Missing: {', '.join(missing)}.",
+                remediation="Set HttpOnly, Secure and SameSite=Lax/Strict on session cookies.",
+                evidence={"cookie": f["name"], "missing": missing},
+            ))
+        else:
+            findings.append(Finding(
+                check=CHECK, status=Status.OK, severity=Severity.INFO,
+                title=f"Cookie flags complete: {f['name']}",
+                detail="HttpOnly / Secure / SameSite present.",
+            ))
+    return findings

loginscan-0.1.0/loginscan/checks/csrf.py

@@ -0,0 +1,44 @@
+"""CSRF protection check (passive).
+
+Looks at the login page for a defense: a CSRF token field/meta, a CSRF cookie,
+or a SameSite cookie. If none is present, CSRF is likely possible.
+"""
+from __future__ import annotations
+
+import re
+from typing import List
+
+from ..http import HttpClient
+from ..models import Finding, ScanConfig, Severity, Status
+
+CHECK = "csrf"
+
+_TOKEN_INPUT = re.compile(
+    r'<input[^>]*name=["\']?[^"\'>\s]*(?:csrf|xsrf|authenticity|_token)[^"\'>\s]*', re.I)
+_META_TOKEN = re.compile(r'<meta[^>]+name=["\'](?:csrf|xsrf)[-_]?token["\']', re.I)
+_CSRF_COOKIE = re.compile(r"csrf|xsrf", re.I)
+
+
+def run(client: HttpClient, cfg: ScanConfig) -> List[Finding]:
+    page = client.get(cfg.login_page_url or cfg.url)
+    body = page.body
+
+    has_token = bool(_TOKEN_INPUT.search(body) or _META_TOKEN.search(body))
+    has_csrf_cookie = any(_CSRF_COOKIE.search(c.split("=", 1)[0]) for c in page.set_cookies)
+    has_samesite = any("samesite" in c.lower() for c in page.set_cookies)
+
+    if has_token or has_csrf_cookie or has_samesite:
+        how = ("CSRF token" if has_token else
+               "CSRF cookie" if has_csrf_cookie else "SameSite cookie")
+        return [Finding(
+            check=CHECK, status=Status.OK, severity=Severity.INFO,
+            title="CSRF defense present",
+            detail=f"Found a CSRF defense on the login page ({how}).",
+        )]
+
+    return [Finding(
+        check=CHECK, status=Status.WARNING, severity=Severity.MEDIUM,
+        title="No CSRF protection detected on login",
+        detail="No CSRF token, CSRF cookie, or SameSite cookie found; login may be forgeable.",
+        remediation="Add a per-session CSRF token to the login form or set SameSite=Lax/Strict on cookies.",
+    )]

loginscan-0.1.0/loginscan/checks/enumeration.py

@@ -0,0 +1,74 @@
+"""User enumeration detection: does the server treat existing vs unknown users differently?"""
+from __future__ import annotations
+
+from typing import List
+
+from ..http import HttpClient
+from ..models import Finding, ScanConfig, Severity, Status
+from .base import random_username, submit_login
+
+CHECK = "enumeration"
+
+LEN_DIFF_RATIO = 0.15
+TIME_DIFF_SECONDS = 0.5
+
+
+def _norm_body(text: str) -> str:
+    return " ".join(text.split())[:400].lower()
+
+
+def run(client: HttpClient, cfg: ScanConfig) -> List[Finding]:
+    wrong_pw = "wrong-Password-123"
+    r_absent = submit_login(client, cfg, random_username("ghost"), wrong_pw)
+
+    if not cfg.known_username:
+        r_absent2 = submit_login(client, cfg, random_username("ghost2"), wrong_pw)
+        consistent = _norm_body(r_absent.body) == _norm_body(r_absent2.body)
+        return [Finding(
+            check=CHECK, status=Status.SKIPPED, severity=Severity.INFO,
+            title="Enumeration test limited (no known_username)",
+            detail=("Provide a username that really exists (password not needed) for a full test. "
+                    + ("Two unknown-user responses were consistent."
+                       if consistent else "Two unknown-user responses differed, which is suspicious.")),
+            remediation="Re-run with --user / known_username.",
+        )]
+
+    r_present = submit_login(client, cfg, cfg.known_username, wrong_pw)
+
+    if 429 in (r_present.status, r_absent.status):
+        return [Finding(
+            check=CHECK, status=Status.SKIPPED, severity=Severity.INFO,
+            title="Enumeration test unreliable due to rate limiting",
+            detail="One request returned HTTP 429, so the responses cannot be compared fairly.",
+            remediation="Re-run with a higher --delay or after the rate-limit window resets.",
+            evidence={"http": f"{r_present.status} vs {r_absent.status}"},
+        )]
+
+    body_diff = _norm_body(r_present.body) != _norm_body(r_absent.body)
+    len_a, len_b = len(r_present.body), len(r_absent.body)
+    len_diff = abs(len_a - len_b) / max(len_a, len_b, 1) > LEN_DIFF_RATIO
+    status_diff = r_present.status != r_absent.status
+    time_diff = abs(r_present.elapsed - r_absent.elapsed) > TIME_DIFF_SECONDS
+
+    if body_diff or len_diff or status_diff:
+        return [Finding(
+            check=CHECK, status=Status.VULNERABLE, severity=Severity.MEDIUM,
+            title="User enumeration possible",
+            detail="The server answers existing and unknown users differently; valid usernames leak.",
+            remediation="Return the same generic message and HTTP status in both cases.",
+            evidence={"body_differs": body_diff, "length": f"{len_a} vs {len_b}",
+                      "http": f"{r_present.status} vs {r_absent.status}"},
+        )]
+    if time_diff:
+        return [Finding(
+            check=CHECK, status=Status.WARNING, severity=Severity.LOW,
+            title="Timing difference (possible enumeration)",
+            detail="Bodies match but response times differ, hinting password hashing runs only for real users.",
+            remediation="Run a dummy hash verification for unknown users to equalize timing.",
+            evidence={"time": f"{r_present.elapsed:.3f}s vs {r_absent.elapsed:.3f}s"},
+        )]
+    return [Finding(
+        check=CHECK, status=Status.OK, severity=Severity.INFO,
+        title="Responses consistent against enumeration",
+        detail="Existing and unknown users were indistinguishable.",
+    )]