search

BFAs

circle-info

A Brute Force Attack (BFA) involves systematically trying all possible combinations of credentials (e.g., passwords) or encryption keys until the correct one is found.

triangle-exclamation

This can lead to unauthorized access to accounts or systems if strong security measures are not in place, as attackers can eventually guess or discover the correct credential.

circle-check

Implement account lockout mechanisms after a number of failed attempts, use multi-factor authentication (MFA), enforce strong password policies, and apply rate limiting or CAPTCHA to prevent rapid, repeated login attempts.

hashtag
Passwords

The below example is based on TCM's Practical API Hackingarrow-up-right course.

We might be able to enumerate valid usernames via verbose error messages (Figure 1).

Figure 1: Enumerating a valid username based on verbose error messages.

When a valid username is obtained, we can try brute-forcing its password using Burp's Intruder (Figure 2) or CLI tools, such as ffuf.

Figure 2: Brute-forcing admin's password with Intruder.

Based on the above verbose error message (Invalid password) we can try to enumerate more valid users (Figure 3), and if other users are found, we can repeat the above process to enumerate their passwords (Figure 4).

Figure 3: Fuzzing for other valid users based on the verbose error message.
Figure 4: Fuzzing jeremy's password with Intruder.

hashtag
OTPs

The below example is based on HTB's API Attacksarrow-up-right module.

If the password policy is robust enough, we can check if the password reset functionality is vulnerable to BFAs due to weak One Time Passcodes (OTPs) (Figure 5).

Figure 5: Getting the required information for brute-forcing the OTP
Figure 6: Successfully logging in.
PreviousAuthenticationNextTokens

Last updated