The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

In some applications, client-side controls are employed in an attempt

to prevent password-guessing attacks. For example, an application may set a

cookie such as 

failedlogins=1

, and increment this following each

unsuccessful attempt. When a certain threshold is reached, the server will

detect this in the submitted cookie and refuse to process the login attempt.

This kind of client-side defense may prevent a manual attack being launched

using only a browser, but it can of course be trivially bypassed as described in

Chapter 5.

Chapter 6 

■

Attacking Authentication

137

70779c06.qxd:WileyRed  9/14/07  3:13 PM  Page 137

---

Figure 6-2: A successful password-guessing attack

HACK STEPS

■