Enumeration attack
List valid usernames, emails or other resources via systematic probing.
Classic channels: "username already taken" messages, different errors for "wrong password" vs "unknown user", URLs /users/1, /users/2... Defences: generic error messages, rate limiting, UUIDs instead of incrementing IDs.