The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Manually submit several bad login attempts for an account you control,

monitoring the error messages received. 

■

After around 10 failed logins, if the application has not returned any

message about account lockout, attempt to login correctly. If this suc-

ceeds, there is probably no account lockout policy.

■

If you do not control any accounts, attempt to enumerate a valid username

(see the “Verbose Failure Messages” section) and make several bad logins

using this, monitoring for any error messages about account lockout.

■

To mount a brute-force attack, first identify a difference in the application’s

behavior in response to successful and failed logins, which can be used to

discriminate between these during the course of the automated attack. 

■