[Owasp-turkey] Login Sayfasi Anti-Brute Force Algoritmasi

Mon Aug 15 08:42:49 EDT 2011

merhaba,
Gecenlerde listedeki anti-brute force algoritmalari
mailine<https://lists.owasp.org/pipermail/owasp-turkey/2011-July/001305.html>
istinaden
soyle gayet temel bir algoritma gelistirmeye calistim. Iki tablom var;
[Email, Counter] ve [IP, Counter, ResetTime]
LastLogin ise login tablosundan okunabilir ve kullanici adlari email olarak
alinmis diye ongoruyorum. Kendine gore kabul ettigi riskler var,
zayifliklari, abuse case'leri v.b. bildirebilirseniz super olur.

*/**************Kullanici Adi/Sifre Kontrol Kod Blogu - Baslangic
*******************/*

*// tanimlar
EMAIL_COUNTER_LIMIT = 18
IP_COUNTER_LIMIT = EMAIL_COUNTER_LIMIT * 20
IDLE_IP_TIMESPAN = 1 Hour
IDLE_EMAIL_TIMESPAN =  2 Days*
**
*// ip tabanli kontrol*
*If Counter[Request.IP] == IP_COUNTER_LIMIT
  ResetTime[Request.IP] = CurrentTime
Else If Counter[Request.IP] > IP_COUNTER_LIMIT
  If CurrentTime - ResetTime[Request.IP] > IDLE_IP_TIMESPAN
    Counter[Request.IP] = 0
  Else
    Get CAPTCHA from Session
    If There is no CAPTCHA or CAPTCHA is not valid
        If (CurrentTime - LastLogin[Email].Time > IDLE_EMAIL_TIMESPAN) ||
(Request.IP != LastLogin[Email].IP) // optional
          Show CAPTCHA & Store CAPTCHA in Session
          Return*
**
*// email tabanli kontrol*
*If Counter[Request.EMAIL] > EMAIL_COUNTER_LIMIT
  Get CAPTCHA from Session
  If There is no CAPTCHA or CAPTCHA is not valid
    If (CurrentTime - LastLogin[Email].Time > IDLE_EMAIL_TIMESPAN) ||
(Request.IP != LastLogin[Email].IP) // optional
      Show CAPTCHA & Store CAPTCHA in Session
      Return
  Else
    Counter[Request.EMAIL] = 0
*
*// validasyon
If Authentication(Request.EMAIL, Request.PASSWORD) is not Valid
  Counter[Request.EMAIL]++
  Counter[Request.IP]++
*
*/**************Kullanici Adi/Sifre Kontrol Kod Blogu - Bitis
*******************/*

Not: pseudo kodu daha iyi okuyabilmek icin pastebin falan kullanabilirsiniz.

-- 
Bedirhan Urgun
http://www.webguvenligi.org
http://www.owasp.org/index.php/Turkey

TÃ¼rkÃ§e Web Uygulama GÃ¼venliÄŸi E-Posta Listesine Ã¼ye olmak iÃ§in:
https://lists.owasp.org/mailman/listinfo/owasp-turkey
-------------- sonraki bölüm --------------
Bir HTML eklentisi temizlendi...
URL: https://lists.owasp.org/pipermail/owasp-turkey/attachments/20110815/3386b954/attachment.html 