Credential Stuffing

HighWeb Application SecurityA07:2021 – Identification and Authentication Failures

Using leaked username/password pairs from previous breaches, attackers automate login attempts across services exploiting password reuse to take over valid accounts.

Immediate Response

1Block IP ranges and ASNs generating the bulk of attack traffic.
2Force password reset for all accounts that were successfully accessed.
3Enable additional verification (MFA challenge) for suspicious sessions.
4Alert affected users about potential account compromise.

All playbooks

1Implement risk-based authentication that triggers MFA for anomalous logins.
2Integrate HaveIBeenPwned API to reject passwords from known breach datasets.
3Deploy bot detection and CAPTCHA on authentication endpoints.
4Apply progressive rate limiting and account lockout policies.

Long-term Prevention

1Enforce MFA for all user accounts as the default, not optional.
2Monitor and alert on impossible travel and concurrent session anomalies.
3Provide user education on password managers and unique password usage.
4Regularly test authentication defenses with simulated credential stuffing attacks.

Attack vectors

Automated login attempts using leaked credential databases
Distributed attacks using botnets to evade IP-based rate limiting
Targeting password reset flows to bypass login controls
Using CAPTCHA-solving services or headless browsers to bypass bot detection

Indicators of compromise

High volume of login attempts with valid usernames but varying passwords
Increased successful logins followed by unusual account activity
Login traffic from known Tor exit nodes, VPN providers, or datacenter IP ranges
Anomalous geographic login patterns

Tooling

Cloudflare Bot ManagementShape SecurityHaveIBeenPwned APIFail2BanAuth0 Attack Protection