From 129e30d4a79358ce36ccc47cd7c8395d7dbaf20a Mon Sep 17 00:00:00 2001 From: "xuanyi.wang" Date: Thu, 25 May 2023 17:29:07 +0200 Subject: [PATCH] Update page 'OWASP test - Sloetjes' --- OWASP test - Sloetjes.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/OWASP test - Sloetjes.md b/OWASP test - Sloetjes.md index 2293f20..6ee1b19 100644 --- a/OWASP test - Sloetjes.md +++ b/OWASP test - Sloetjes.md @@ -11,11 +11,11 @@ > * If a login attempt fails: > > Record the IP address, timestamp, and username. - > crease the count of failed attempts for this IP address and/or username. + > > crease the count of failed attempts for this IP address and/or username. > * If there are more than a certain number of failed attempts in a certain timeframe from the same IP or username: - > Use a geolocation service to identify the location of the IP. - > Compare this location to the known or expected location of the user. - > Check the user's permission level. Higher-risk users (like admins) may warrant tighter security measures. + > > Use a geolocation service to identify the location of the IP. + > > Compare this location to the known or expected location of the user. + > > Check the user's permission level. Higher-risk users (like admins) may warrant tighter security measures. > * If the location doesn't match or there are too many attempts, it may be a brute force or break-in attempt. Notify the administrators based on these factors. * Describe the lifetime of a session-only cookie, and how this could be used to create a session authorization token.