When testing a web application authentication mechanism, you entered $$XXX$$ as user name, and a blank password, the system generated the message $$Sorry$,$ there is no user by that name in our system$.$ You then entered $$test$123$ as user name, and $$pass$$ as password, the system generated the message $$Sorry$,$ bad user name$/$password combination$.$ What conclusion can you draw without probing any further?$$

What vulnerability does this disclose about the web application?$$To break the authentication mechanism, what will you do next $($or what technique will you use next$)?$