The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Prevent Brute-Force Attacks

■■

Measures need to be enforced within all of the various challenges

implemented by the authentication functionality in order to prevent

attacks that attempt to meet those challenges using automation. This

includes the login itself, as well as functions to change password, to

recover from a forgotten password situation, and the like.

■■

Using unpredictable usernames and preventing their enumeration pre-

sents a significant obstacle to completely blind brute-force attacks, and