Practical Network Scanning

Preventing an authentication hacking attack

Authentication plays a very critical role in the security of web applications. Attackers will try to find passwords or session IDs and get access to the desired information. Here are a few ways to prevent an authentication hacking attack:

• Prevent an automated brute force attack by adding CAPTCHA. However, this is not perfect. Along with CAPTCHA, use account lock-down. This is a very effective deterrent against brute force attacks.
• Transfer session keys in cookies (do not show session IDs in the URL) and session keys should be unpredictable. Showing session IDs with the URL is a method that is normally used when cookies are blocked by client side or a fallback method.
• Keep the duration shorter for ...