Broken Authentication - Password Brute-Force via Password Change
Support This Channel
======================
Please like and subscribe, it means a lot!
Please buy me a coffee so I can continue to make content.
https://buymeacoffee.com/zenshell
My cybersec and webdev training site
https://www.zenshell.ninja
Join our Discord
/ discord
We explore problems with a password change functionality that allows us to brute force the victim's account.
Although there is some brute force protection in place, it's possible to bypass this. The web app leaks information about the validity of the passwords through differing response to the page.