Exploiting Verbose Errors and No Lockout for Brute Force
A penetration tester is conducting an assessment of a web application for a financial institution. The application uses form-based authentication and does not implement account lockout policies after multiple failed login attempts. Interestingly, the application displays detailed error messages that disclose whether the username or password entered is incorrect. The tester also notices that the application uses HTTP headers to prevent clickjacking attacks but does not implement Content Security Policy (CSP). With these observations, which of the following attack methods would likely be the most effective for the penetration tester to exploit these vulnerabilities and attempt unauthorized access?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The core test is recognizing that detailed error messages allowing username/password distinction, paired with no lockout, create an ideal environment for targeted brute force or credential stuffing attacks.
This question examines how verbose error messages and missing account lockout policies facilitate credential guessing attacks against web applications. It establishes that the absence of lockout mechanisms combined with informative feedback is the primary vulnerability enabling brute force success.
Test-takers often select SQL Injection (A) or XSS (D) because they are common web vulnerabilities, ignoring the specific contextual clues about authentication mechanics provided in the scenario.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is B because the scenario explicitly describes two critical weaknesses: the lack of an account lockout policy and verbose error messages. These conditions allow an attacker to systematically guess credentials without being blocked and to verify their guesses instantly based on the server's response. This combination is the textbook definition of a vulnerable setup for a brute force attack.Why the Other Options Are Wrong
Option A (SQL Injection) is incorrect because there is no evidence of input manipulation points; the focus is on authentication logic. Option C (MitM/Clickjacking) is incorrect because the application already implements headers to prevent clickjacking, and MitM requires network access not mentioned. Option D (XSS) is incorrect because while CSP is missing, the immediate exploitable weakness described relates to authentication failure handling, not script injection.Community Comment Notes
The community consensus strongly supports option B, with users noting that the lack of lockout and detailed errors makes brute force the logical choice. Comments highlight that these specific misconfigurations are direct enablers for credential guessing techniques.Exam Strategy
Always map the symptoms in the question stem to the attack vector. If you see 'no lockout' and 'verbose errors', think 'Brute Force' or 'Credential Stuffing'. Do not assume other complex attacks unless specific technical indicators (like SQL syntax errors or script tags) are present.
Frequently Asked Questions
Why isn't SQL Injection the best choice here?
SQL Injection requires inputs that interact with database queries. The scenario focuses on authentication feedback and lockout policies, which are irrelevant to SQLi.
Does missing CSP enable brute force?
No. Missing CSP enables Cross-Site Scripting (XSS). Brute force is enabled by the lack of account lockout and verbose error messages during login attempts.