Web Application Defender's Cookbook

Recipe 7-2: Detecting the Submission of Multiple Usernames

This recipe shows you how to identify when attackers cycle through many different usernames during authentication attempts.

Ingredients

• ModSecurity
  • SecRule directive
  • @within operator
  • initcol action
  • setvar action
  • expirevar action

Because most average users choose weak passwords, attackers can easily pick a simple password and then cycle through various known usernames in hopes of hitting on a valid combination. Let’s look at some real-world attack examples.

Horizontal Brute-Force Scanning

One of the projects I lead for the Web Application Security Consortium (WASC) is the Distributed Web Honeypot Project. As part of this project, participants can deploy open proxy Apache web servers that attackers will eventually use to loop their attack traffic through in hopes of hiding their source IP address. While monitoring the honeypot traffic, we identified a widespread authentication attack against Yahoo! accounts. Here is a sample of the attack traffic:

GET http://217.12.8.76/config/isp_verify_user?l=bandit_unreal&
p=123456 HTTP/1.0
GET http://202.86.7.110/config/isp_verify_user?l=federico_lara&
p=123456 HTTP/1.0
GET http://202.86.7.110/config/isp_verify_user?l=felipe_rogelio&
p=123456 HTTP/1.0
GET http://66.163.169.179/config/isp_verify_user?l=bambi_shelton&
p=123456 HTTP/1.0
GET http://119.160.244.232/config/isp_verify_user?l=dinamis18&
p=123456 HTTP/1.0 GET https://login.yahoo.com/config/isp_verify_user?l=felix_pay& ...