Re: SPAM-LOW: passw0rd trial limit

Hi,

well a lil countermeasure is increase the delay it takes to answer the
login process the more requests are send. But in the end this method got
nearly the same drawbacks, and makes it easier for attackers (they may
try more often than in an 2 hour block).

The ban of IP's was already mentioned, and so was the workaround.

You may show the person who logs in the number of failed logins so he
will notice if someone is trying to brute-force his account. Therefore u
need users who are aware of this, and are willing to pass this
information to an admin or whoever is in charge of this kinda stuff.
Then the attack may even be tracked down, if the brute-force process is
discovered soon.

Chriz


Hey,

Disabling users is a kind of control that many companies use as
countermeasure for brute force attacks.

Can any one tell me, what are the other controls to prevent such kind of
attack?

Mohsin Ahmed

-----Original Message-----
From: ceyhun [mailto:jhun39@xxxxxxxxx]
Sent: Saturday, June 24, 2006 3:40 AM
To: pen-test@xxxxxxxxxxxxxxxxxxxxxxx
Subject: SPAM-LOW: passw0rd trial limit

hi

i am trying to pen test a web site

site has a login page and all the usernames are known
the passw0rd length is fixed and 6 characters long

i think with a brute force attack it wold be easy to login as any user,

but the problem is when a user enters wrong paaw0rd more than five times
he/she can only login for aboout 2 hours later

how this obstacle can be overcomed do you have any idea?

by the way remote server accepts another user login wehther you have
exceeded trial limit or not
so i think it is not related with the ip filtering


----------------------------------------------------------------------------
--
This List Sponsored by: Cenzic

Concerned about Web Application Security?
Why not go with the #1 solution - Cenzic, the only one to win the Analyst's
Choice Award from eWeek. As attacks through web applications continue to
rise,
you need to proactively protect your applications from hackers. Cenzic has
the
most comprehensive solutions to meet your application security penetration
testing and vulnerability management needs. You have an option to go with a
managed service (Cenzic ClickToSecure) or an enterprise software
(Cenzic Hailstorm). Download FREE whitepaper on how a managed service can
help you: http://www.cenzic.com/news_events/wpappsec.php
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request@xxxxxxxxxx for details.
----------------------------------------------------------------------------
--



------------------------------------------------------------------------------
This List Sponsored by: Cenzic

Concerned about Web Application Security?
Why not go with the #1 solution - Cenzic, the only one to win the Analyst's
Choice Award from eWeek. As attacks through web applications continue to rise,
you need to proactively protect your applications from hackers. Cenzic has the
most comprehensive solutions to meet your application security penetration
testing and vulnerability management needs. You have an option to go with a
managed service (Cenzic ClickToSecure) or an enterprise software
(Cenzic Hailstorm). Download FREE whitepaper on how a managed service can
help you: http://www.cenzic.com/news_events/wpappsec.php
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request@xxxxxxxxxx for details.
------------------------------------------------------------------------------




------------------------------------------------------------------------------
This List Sponsored by: Cenzic

Concerned about Web Application Security?
Why not go with the #1 solution - Cenzic, the only one to win the Analyst's
Choice Award from eWeek. As attacks through web applications continue to rise,
you need to proactively protect your applications from hackers. Cenzic has the
most comprehensive solutions to meet your application security penetration
testing and vulnerability management needs. You have an option to go with a
managed service (Cenzic ClickToSecure) or an enterprise software
(Cenzic Hailstorm). Download FREE whitepaper on how a managed service can
help you: http://www.cenzic.com/news_events/wpappsec.php
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request@xxxxxxxxxx for details.
------------------------------------------------------------------------------

Relevant Pages

  • Re: Stopping Arp poison attacks
    ... I am not a networking expert, but in my work as a pentester i often use arp ... As attacks through web applications continue to rise, ... Download FREE whitepaper on how a managed service can ... Download FREE whitepaper on how a managed service can help you: http://www.cenzic.com/news_events/wpappsec.php And, now for a limited time we can do a FREE audit for you to confirm your results from other product. ...
    (Pen-Test)
  • RE: Stopping Arp poison attacks
    ... DHCP snooping won't necessarily stop ARP Attacks.. ... Subject: Stopping Arp poison attacks ... Download FREE whitepaper on how a managed service ...
    (Pen-Test)
  • Re: Stopping Arp poison attacks
    ... is using static arp tables. ... usualy MITM attacks takes place after the login. ... a managed service can ... Download FREE whitepaper on how a managed service can ...
    (Pen-Test)
  • Re: passw0rd trial limit
    ... he/she can only login for aboout 2 hours later ... configuration)--then brute force the logins. ... As attacks through web applications continue to rise, you need to proactively protect your applications from hackers. ... You have an option to go with a managed service or an enterprise software. ...
    (Pen-Test)
  • Re: tcp proxy for middle man attack
    ... includes some MITM attacks: http://ettercap.sourceforge.net/ ... As attacks through web applications continue to rise, ... Download FREE whitepaper on how a managed service can ...
    (Pen-Test)