Link to home
Start Free TrialLog in
Avatar of skyjumperdude
skyjumperdude

asked on

Login Brute Force Vulnerability issues

We have a web portal which requires a login. We would like to secure the login from Brute Force Vulnerabilities. Our scanner is detecting the following issue. How can we fix this?

This vulnerability occurs when a malicious user succeeds to guess a valid username and password that will enable them to authenticate illicitly to a Web
application.
The username and password would be "guessed" based on a generated list that can come from two sources: a user-defined configuration, or an internal list
provided by the WAS module based on the most common usernames and passwords.
ASKER CERTIFIED SOLUTION
Avatar of Delete
Delete
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of Big Monty
i would do both if you're really concerned about security, lock the account after x amount of attempts, and also add something like captcha the end user has to enter in before the form is submitted.

of course, this can be a real pain in the butt to the end user to have to enter in captcha details every time they log in. it's something you'll have to weigh in on, security vs ease of use