Recipe 7-2: Detecting the Submission of Multiple Usernames
This recipe shows you how to identify when attackers cycle through many different usernames during authentication attempts.
Ingredients
  • ModSecurity
    • SecRule directive
    • @within operator
    • initcol action
    • setvar action
    • expirevar action
Because most average users choose weak passwords, attackers can easily pick a simple password and then cycle through various known usernames in hopes of hitting on a valid combination. Let’s look at some real-world attack examples.
Horizontal Brute-Force Scanning
One of the projects I lead for the Web Application Security Consortium (WASC) is the Distributed Web Honeypot Project. As part of this project, participants can deploy open proxy Apache web servers that attackers will eventually use to loop their attack traffic through in hopes of hiding their source IP address. While monitoring the honeypot traffic, we identified a widespread authentication attack against Yahoo! accounts. Here is a sample of the attack traffic: 
GET http://217.12.8.76/config/isp_verify_user?l=bandit_unreal&
p=123456 HTTP/1.0
GET http://202.86.7.110/config/isp_verify_user?l=federico_lara&
p=123456 HTTP/1.0
GET http://202.86.7.110/config/isp_verify_user?l=felipe_rogelio&
p=123456 HTTP/1.0
GET http://66.163.169.179/config/isp_verify_user?l=bambi_shelton&
p=123456 HTTP/1.0
GET http://119.160.244.232/config/isp_verify_user?l=dinamis18&
p=123456 HTTP/1.0 GET https://login.yahoo.com/config/isp_verify_user?l=felix_pay& ...

Get Web Application Defender's Cookbook now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial