new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

authentication/automated_attacks

5 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Automated attack types against authentication

Common types of automated attacks against authentication include: Brute Force (testing multiple passwords from a dictionary against a single account); Credential Stuffing (testing username/password pairs obtained from breaches of other sites); Password Spraying (testing a single weak password against a large number of different accounts).

CAPTCHA as defense-in-depth against brute force

An effective CAPTCHA can help prevent automated login attempts against accounts. However, many CAPTCHA implementations have weaknesses and can be solved using automated techniques or outsourced services. CAPTCHA should be viewed as a defense-in-depth control to make brute-force attacks more time-consuming and expensive, rather than as a preventative. It may be more user-friendly to require CAPTCHA only after a small number of failed login attempts.

Security questions should not be used as MFA

Security questions or memorable words can help protect against automated attacks, but they should not be considered multi-factor authentication since both factors are the same (something you know). Security questions are often weak and have predictable answers, so they must be carefully chosen. See the Choosing and Using Security Questions cheat sheet for further guidance.

Forgot Password: implement rate limiting to prevent enumeration and flooding

Implement protections against excessive automated submissions such as rate-limiting on a per-account basis, requiring a CAPTCHA, or other controls to prevent attackers from making thousands of password reset requests per hour that could flood the user's email inbox or SMS.

Brute force protection using throttling attribute

Use the AllowXRequestsEveryXSecondsAttribute decorator on LogOn actions to throttle requests. Example: [AllowXRequestsEveryXSecondsAttribute(Name = "LogOn", Message = "You have performed this action more than {x} times in the last {n} seconds.", Requests = 3, Seconds = 60)]. This limits login attempts to 3 requests per 60 seconds.

Give your agent this brain