Watch your door.-Authentication mechanism is attacked (1)-Password is not strong

The first thing to declare is that this article is purely an ignorant view of a little developer without foresight and knowledge, and is intended only for reference in Web system security.

1. Brief description

In siege, the gate is always the easiest place to be breached.
If a web system is not secure enough, there are often problems from landing on it.
Many Web applications have no or little control over the strength of the user's password, so it's easy to find a loophole here;

2, common confidentiality is not strong password

Very short or even blank password;
The password and user name are exactly the same;
The initial default password;
Use common vocabulary Pinyin, English, etc. as the password;
Like what:
123
123456
Site name
Qwert (look at the keyboard carefully)
11111
Admin
Qaz123
...

3. The process of being attacked

1, first to identify and password strength-related rules;
2, if it is a public Web site, find the description of password and user name-related content;
3, if you can do self-registration, with a fragile password to register different accounts, see what the application actually adopted the rules;
4, if you have a password, change the password for a variety of confidential password not strong try.
5, for the general application, the protection of most people is enough, if someone own ways to change the strong password into a weak password, it is his own things. The so-called "no Zuo,no die"

Watch your door.-Authentication mechanism is attacked (1)-Password is not strong