Watch your door.-Authentication mechanism is attacked (7)-Predictable user name and password

The first thing to declare is that this article is purely an ignorant view of a little developer without foresight and knowledge, and is intended only for reference in Web system security.

1. Brief description

Some applications automatically generate account names in some order, of course, now the mailbox, mobile phones, QQ numbers become more and more likely to be usernames, attackers are more and more convenient;
Some applications create users in large batches and automatically specify the initial password, and then assign the password to the user in some way (mail, text message).

2. Common vulnerabilities for predictable user names and passwords

The user name and password can be predicted, and of course, the vulnerability here is very large.
A predictable initialization password allows an attacker to predict the password of other application users, a vulnerability that is often present in intranet-based enterprise applications.
If all users receive the same password, or a password created based on their username and job title, ID, phone number, etc., this password can be easily compromised.
Worse than that, many people have the initial password, almost no modification, has been used, if the initial password is too complex, many people will move from one extreme to another, using the simplest possible password.

3. Common attack strategies

If the password is an application generation, try to get several consecutive passwords to see if there is a sequence or pattern;
If there is a sequence or pattern, still this method is inferred, other system user's password;
If the password presents a connection that may be related to the user name, then go directly to speculate on the other user name and password;
If there is no sequence or pattern to discover, then these series of usernames and passwords are the basis for brute force cracking.

Watch your door.-Authentication mechanism is attacked (7)-Predictable user name and password