the-web-application-hackers-handbook

162 Chapter 6 n Attacking Authentication
Figure 6-1: An application that enforces weak password quality rules
HACK STEPS
Attempt to discover any rules regarding password quality:
1. Review the website for any description of the rules.
2. If self-registration is possible, attempt to register several accounts with
different kinds of weak passwords to discover what rules are in place.
3. If you control a single account and password change is possible, attempt
to change your password to various weak values.
NOTE If password quality rules are enforced only through client-side controls,
this is not itself a security issue, because ordinary users will still be
protected. It is not normally a threat to an application’s security that a crafty
attacker can assign himself a weak password.
TRY IT!
http://mdsec.net/auth/217/
Brute-Forcible Login
Login functionality presents an open invitation for an attacker to try to guess
usernames and passwords and therefore gain unauthorized access to the application.
If the application allows an attacker to make repeated login attempts