[Owasp-leaders] https://www.owasp.org/index.php/Credential_stuffing

Rogan Dawes rogan at dawes.za.net
Tue Sep 20 03:42:44 UTC 2016


>From a detection perspective, how is an attacker doing a horizontal brute
force attack (most commonly defined as checking all users for a single
common password) different from an attacker checking a list of users and
passwords?

I can't see any difference myself.

You monitor login attempts, increment failed logins per user, increment
failed logins per ip address, and lock out or ban (or tar pit) once
thresholds are exceeded.

Rogan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.owasp.org/pipermail/owasp-leaders/attachments/20160920/75c37323/attachment-0001.html>


More information about the OWASP-Leaders mailing list