Cobalt Vulnerability Wiki
Cobalt Vulnerability Wiki
Categories
V2 - AuthenticationAuthentication Bypass2-Factor Authentication (2FA) BypassCAPTCHA Bypass - X-Forwarded-ForLack of Password ConfirmationLack of Verification EmailMail Bombing in the Contact FormMissing brute-force protection for two-factor authenticationNo Rate Limiting on a FormNo Rate Limiting or Captcha on Login PagePassword Cracking for Common/Weak Passwords when Password Policy is WeakUsername/Email Address EnumerationUsing Default Credentials Weak 2FA ImplementationWeak Login FunctionWeak Password PolicyWeak Registration Implementation over HTTP
V3 - Session ManagementV4 - Access ControlV5 - Validation/SanitizationV6 - CryptographyV7 - Error LoggingV8 - Data ProtectionV9 - CommunicationsV10 - Malicious CodeV11 - Business LogicV12 - Files ResourcesV13 - APIV14 - ConfigV2 - Authentication
Missing brute-force protection for two-factor authentication
POC
1. Send the request to Burp Intruder that requires the 2FA code
2. Brute force 2-factor code parameter
3. Observe difference in the length of response between correct and incorrect code
Impact
Low-Medium
Likelihood
Low
Ready to get started?
Join some of these great clients we're proud to have helped