BFAs
This can lead to unauthorized access to accounts or systems if strong security measures are not in place, as attackers can eventually guess or discover the correct credential.
Implement account lockout mechanisms after a number of failed attempts, use multi-factor authentication (MFA), enforce strong password policies, and apply rate limiting or CAPTCHA to prevent rapid, repeated login attempts.
Passwords
The below example is based on TCM's Practical API Hacking course.
We might be able to enumerate valid usernames via verbose error messages (Figure 1).
When a valid username is obtained, we can try brute-forcing its password using Burp's Intruder (Figure 2) or CLI tools, such as ffuf.
admin's password with Intruder.Based on the above verbose error message (Invalid password) we can try to enumerate more valid users (Figure 3), and if other users are found, we can repeat the above process to enumerate their passwords (Figure 4).
jeremy's password with Intruder.OTPs
The below example is based on HTB's API Attacks module.
If the password policy is robust enough, we can check if the password reset functionality is vulnerable to BFAs due to weak One Time Passcodes (OTPs) (Figure 5).
Last updated
Was this helpful?