the-web-application-hackers-handbook

Chapter 6 n Attacking Authentication 165
3. If the account is locked out, try repeating the exercise using a different
account. This time, if the application issues any cookies, use each cookie
for only a single login attempt, and obtain a new cookie for each subsequent
login attempt.
4. Also, if the account is locked out, see whether submitting the valid password
causes any difference in the application’s behavior compared to an
invalid password. If so, you can continue a password-guessing attack even
if the account is locked out.
5. If you do not control any accounts, attempt to enumerate a valid username
(see the next section) and make several bad logins using this.
Monitor for any error messages about account lockout.
6. To mount a brute-force attack, first identify a difference in the application’s
behavior in response to successful and failed logins. You can use
this fact to discriminate between success and failure during the course of
the automated attack.
7. Obtain a list of enumerated or common usernames and a list of common
passwords. Use any information obtained about password quality rules to
tailor the password list so as to avoid superfluous test cases.
8. Use a suitable tool or a custom script to quickly generate login requests
using all permutations of these usernames and passwords. Monitor
the server’s responses to identify successful login attempts. Chapter 14
describes in detail various techniques and tools for performing customized
attacks using automation.
9. If you are targeting several usernames at once, it is usually preferable
to perform this kind of brute-force attack in a breadth-first rather than
depth-first manner. This involves iterating through a list of passwords
(starting with the most common) and attempting each password in turn
on every username. This approach has two benefits. First, you discover
accounts with common passwords more quickly. Second, you are less
likely to trigger any account lockout defenses, because there is a time
delay between successive attempts using each individual account.
TRY IT!
http://mdsec.net/auth/16/
http://mdsec.net/auth/32/
http://mdsec.net/auth/46/
http://mdsec.net/auth/49/