Invalid credential stuffing Protection Policy cookie

Invalid credential stuffing Protection Policy cookie

The library hit AttacK Defense solution here mentions some unreliable solutions. This time, we will share an unreliable solution that uses cookies to identify users.

The test object is a well-known vertical e-commerce company.

Login Request: Human bypass ~

POST/web/_ login HTTP/1.1 Accept-Encoding: gzip, deflate Accept-Language: zh-CN, zh; q = 0.8, en; q = 0.6 Cookie: PHPSESSID = i564ka1k5g98l510vsaiftret5; _ key = California; RA-Ver: 2.9.0 RA-Sid: California AlexaToolbar-ALX_NS_PH: AlexaToolbar/alxg-3.3 username = 1111 & passwd = 22222 & code =

When multiple attempts to log on fail, the server returns:

{"Result": "show_code", "msg": "\ u9a8c \ u8bc1 \ u7801 \ u9519 \ u8bef "}

Unicode decoding is a verification code error. The request contains a code field. It seems that you need to enter the verification code. Defense measures were taken.

After the cookie is deleted, the server returns the following request:

{"Result": "username_error", "msg": "\ u624b \ u673a \ u53f7 \ u7801 \ u9519 \ u8bef "}

The user name does not exist. Therefore, the server uses cookies to determine whether a request is sent multiple times and whether a verification code is required. As long as no cookie is sent, attackers can easily bypass server judgment and perform brute force cracking and credential stuffing.