Hi Adam, To play with dictionary attacks, try www.accessdiver.com - Its quite handy with a range of functionality and is very easy to drop in complete new dictionary lists, as well as its default dictionary is quite effective.
Generally if I'm securing these sort of details I maintain a 'IP failure' list. I simply record the remote ID, and log the number of failures. After 3 login failures, I generate and email/sms depending on the app to the administrator, and add the IP to an autodump list. (Your IP address has been blocked due to multiple failures, please contact <email> to have your a$$ kicked. Depending on the level of the application, you can have your network guys call your DB of blocked IP's to drop them at the router level, or do some other niftyness. Keep in mind, this isn't absolute. Dictionary attacks are bloody difficult to prevent. Using script kiddy utils like access diver, or custom scripting you can rewrite your HTTP headers for the request, or rotate through anonymous proxies. www.astalavista.com is a nice starting point when looking for lists of anonymous proxy servers. On secured apps I typically just add all the IP's to the filters permanently. you also generally want to add a timer of some sort to clear proxy servers or ip's in general. With dictionary attacks, you'll typically find that you get a VERY large number of attacks in a short time span. Generally even if you just throw a half hour delay every 3 or 4 attempts and check your logs every couple of days, your going to be able to stop dictionary attacks in there tracks. The other security paranoid option against Dictionary attacks is to just stop authentication if the failures count is greater then 50, and notify an admin who can check the logs and reenable auth if its a false alarm, or take appropriate action if its a genuine attempt. ----- Original Message ----- From: "Adam Chapman" <[EMAIL PROTECTED]> To: "CFAussie Mailing List" <[EMAIL PROTECTED]> Sent: Monday, February 24, 2003 2:38 PM Subject: [cfaussie] Dictionary attacks > Hey Everyone.. > > At the hack-proofing CFMX session at MXDU, Spike > Mentioned a 'dictionary attack' or something similar > Where someone will pound your cf templates with lots-o > Username/password combos.. > > What are some of the methods peoples use to try and > Safeguard against this kind of thing..? > > Regards, > Adam Chapman > > Virtualtours.com.au > mailto:[EMAIL PROTECTED] > Phone: 1300 366 122 > (Int: +61 3 9720 5733) > Fax: +61 3 9720 6377) > > > --- > You are currently subscribed to cfaussie as: [EMAIL PROTECTED] > To unsubscribe send a blank email to [EMAIL PROTECTED] > > MX Downunder AsiaPac DevCon - http://mxdu.com/ > --- You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To unsubscribe send a blank email to [EMAIL PROTECTED] MX Downunder AsiaPac DevCon - http://mxdu.com/
