This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit

Testing for Brute Force (OWASP-AT-004)

Revision as of 11:46, 4 November 2006 by Gfedon (talk | contribs) (Description of the Issue)

Jump to: navigation, search

OWASP Testing Guide v2 Table of Contents

Brief Summary

Brute-forcing consists of systematically enumerating all possible candidates for the solution and checking whether each candidate satisfies the problem's statement. In web application testing, the problem we are going to face with the most is very often connected with the need of having a valid user account to access the inner part of the application. Therefore we are going to check different types of authentication schema and the effectiveness of different brute-forcing attacks.

Description of the Issue

A great majority of web applications provide a way for users to authenticate themselves. By having knowledge of user's identity it's possible to create protected areas or more generally, to have the application behave differently upon the logon of different users. Actually there are several methods for a user to authenticate to a system like certificates, biometric devices, OTP (One Time Password) tokens, but in web application we usually find a combination of user ID and password. Therefore it's possible to carry out an attack to retrieve a valid user account and password, by trying to enumerate many (ex. dictionary attack) or the whole space of possible candidates.

After a successful bruteforce attack, a malicious user could have access to:

  • Confidential information / data;

Private sections of a web application, could disclose confidential documents, user's profile data, financial status, bank details, user's relationships, etc..

  • Administration panels;

These sections are used by webmasters to manage (modify, delete, add) web application content, manage user provisioning, assign different privileges to the users, etc..

  • Availability of further attack vectors;

Inner sections of a web application could contain advanced functionalities not available to not authorized users and hide dangerous vulnerabilities.

Black Box testing and example

Testing for Topic X vulnerabilities:
Result Expected:

Gray Box testing and example

Testing for Topic X vulnerabilities:
Result Expected:



OWASP Testing Guide v2

Here is the OWASP Testing Guide v2 Table of Contents OWASP Testing Guide v2 Table of Contents

This article is a stub. You can help OWASP by expanding it or discussing it on its Talk page.