Web Application Defender's Cookbook

Recipe 7-1: Detecting the Submission of Common/Default Usernames

This recipe shows you how to detect when attackers attempt to submit common or default usernames when authenticating to the application.

Ingredients

• ModSecurity
  • SecRule directive
  • ARGS variable
  • @pm operator

When applications are initially installed, they often come preconfigured with default accounts. These accounts normally have some legitimate purpose, such as a test or administrator account. These accounts also often are preset with a default password. This fact would not pose a problem if all application owners properly removed, deactivated, or set a new password on these accounts. Sadly, this is not the case. Attackers know this and usually attempt to access these default accounts. Here are some common default account names:

• admin
• administrator
• root
• system
• guest
• operator
• super
• test
• qa
• backup

These default accounts also often have default passwords, or the site owners set easily guessed ones, such as these:

• blank (no password set)
• admin
• pass
• pass123
• password
• password123
• changeme
• qwerty

Identifying the Username Parameter Field

To analyze the username submitted in an authentication attempt, we must review the full HTTP transaction. Let’s use the standard WordPress login, shown in Figure 7-1, as our example.

Figure 7-1: WordPress Login page

When the user clicks the Login button, the credentials are ...