Testing for weak lockout mechanisms
Account lockout mechanisms should be present within an application to mitigate brute-force login attacks. Typically, applications set a threshold between three to five attempts. Many applications lock accounts for a period before a re-attempt is allowed.
Penetration testers must test all aspects of login protections, including challenge questions and responses, if present.
Getting ready
Determine whether an application has proper lockout mechanisms in place. If they are not present, attempt to brute-force credentials against the login page to achieve unauthorized access to the application. Using the OWASP Mutillidae II application, attempt to log in five times with a valid username but an invalid password.
How to do it...
Ensure Burp Suite and the OWASP BWA VM are running and that Burp Suite has been configured in your Firefox browser so that you can view the OWASP BWA applications:
- From the OWASP BWA landing page, click the...
