Practical Web Penetration Testing

Spoofing – authentication

Threat Description	Threat action aimed to illegally access and use another user's credentials, such as username and password.
Threat Target	Customer and employee credentials.
Attacker Steps	An attacker can do the following: Steal the credentials through social engineering Brute-force attempts to get into the system Perform an SQL injection to bypass authentication or extract a user's credentials Intercept and steal the session cookie from a user
Counter-Measure	Secure Password Policy Sessions Timeout Account Lockout against brute-force attacks Logging failed attempts Validation against SQLi and XSS The admin console for WordPress is only accessible through the intranet
Existing Counter-Measure ...