From 19656179b01c73b7ec4545f65cc8843cc9751ecc Mon Sep 17 00:00:00 2001 From: "xuanyi.wang" Date: Thu, 25 May 2023 17:10:18 +0200 Subject: [PATCH] Update page 'OWASP test - Sloetjes' --- OWASP test - Sloetjes.md | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-) diff --git a/OWASP test - Sloetjes.md b/OWASP test - Sloetjes.md index 8c54c05..2131fa5 100644 --- a/OWASP test - Sloetjes.md +++ b/OWASP test - Sloetjes.md @@ -8,19 +8,14 @@ * Describe some logic to monitor failed logins, and using geolocation of the incoming IP address, the permissions of the username trying to log in, and the number of previously failed logins, a procedure to determine whether to alert administrators to a genuine break-in attempt vs a brute-force attempt. > Monitor each login attempt, successful or not. - If a login attempt fails: - Record the IP address, timestamp, and username. - Increase the count of failed attempts for this IP address and/or username. - If there are more than a certain number of failed attempts in a certain timeframe from the same IP or username: - Use a geolocation service to identify the location of the IP. - Compare this location to the known or expected location of the user. - Check the user's permission level. Higher-risk users (like admins) may warrant tighter security measures. - If the location doesn't match or there are too many attempts, it may be a brute force or break-in attempt. Notify the administrators based on these factors. - - - - - + > If a login attempt fails: + > Record the IP address, timestamp, and username. + > Increase the count of failed attempts for this IP address and/or username. + > If there are more than a certain number of failed attempts in a certain timeframe from the same IP or username: + > Use a geolocation service to identify the location of the IP. + > Compare this location to the known or expected location of the user. + > Check the user's permission level. Higher-risk users (like admins) may warrant tighter security measures. + > If the location doesn't match or there are too many attempts, it may be a brute force or break-in attempt. Notify the administrators based on these factors. * Describe the lifetime of a session-only cookie, and how this could be used to create a session authorization token. * Describe the logic the web server should use when being presented with a session authorization token from a user, which isn't in the server's corresponding database.