#PT12068_6 - Login page vulnerable to bruteforce attacks

Server Security Misconfiguration > No Rate Limiting on Form > Login

Proof of Concept

1. Browse "https://pentest.beta.nuxeocloud.com/nuxeo/login.jsp" URL for login attempt

1. Place a random username and password in username and password areas,

1. Use a proxy tool like burpsuite to intercept HTTP traffic.

1. Click "Log in" button on login page.

1. Intercept and send the request to the Intruder module on burpsuite tool.

1. Clear all reference point and place only a reference on "password" parameter.

1. On Payloads tab, use wordlist

1. Start attack and observe how the login form is vulnerable to the brute force attack.

Suggested Fix

implement multi-factor authentication