AUTHENTICATION (AT7)
Cecilia can use brute force and dictionary attacks against one or many accounts without limit, or these attacks are simplified due to insufficient complexity, length, expiration and re-use requirements for passwords
Cecilia can use brute force and dictionary attacks against one or many accounts without limit, or these attacks are simplified due to insufficient complexity, length, expiration and re-use requirements for passwords
OWASP SCP
33,38,39,41,50,53
OWASP ASVS
2.1.2,2.1.7,2.1.10,2.2.1
OWASP AppSensor
AE2,AE3
CAPEC
-
SAFECODE
27
Attacks should be prevented from being able to obtain valid account credentials by using the application in an unintended manner. This includes credential cracking (identifying valid login credentials by trying different values for usernames and/or passwords) and credential stuffing (mass log in attempts used to verify the validity of stolen username/password pairs).
NB: This card relates to passwords. See AT 4 for the similar user name attacks.
Mappings
OWASP ASVS (4.0): 2.1.2 ,2.1.7 ,2.1.10 ,2.2.1
OWASP SCP: 33,38,39,41,50,53
OWASP Appsensor: AE2,AE3
Safecode: 27
ASVS (4.0) Cheatsheetseries Index
ASVS V2.1 - Password Security Requirements
ASVS V2.2 - General Authenticator Requirements
No suitable mappings were found.
Attacks
Password Guessing/Brute Force Attacks
