Exploiting Verbose Errors and No Lockout for Brute Force

312-50v12 By islever Editorial Last updated

Hacking Web Applications

Short answer

B The tester executes a Brute Force attack by leveraging the lack of account lockout and verbose error messages to guess credentials.

Question

A penetration tester is conducting an assessment of a web application for a financial institution. The application uses form-based authentication and does not implement account lockout policies after multiple failed login attempts. Interestingly, the application displays detailed error messages that disclose whether the username or password entered is incorrect. The tester also notices that the application uses HTTP headers to prevent clickjacking attacks but does not implement Content Security Policy (CSP). With these observations, which of the following attack methods would likely be the most effective for the penetration tester to exploit these vulnerabilities and attempt unauthorized access?
  1. The tester could exploit a potential SQL Injection vulnerability to manipulate the application's database.
  2. The tester could execute a Brute Force attack, leveraging the lack of account lockout policy and the verbose error messages to guess the correct credentials. Correct Answer
  3. The tester could execute a Man-in-the-Middle (MitM) attack to intercept and modify the HTTP headers for a Clickjacking attack.
  4. The tester could launch a Cross-Site Scripting (XSS) attack to steal authenticated session cookies, potentially bypassing the clickjacking protection.

Key Takeaways

The core test is recognizing that detailed error messages allowing username/password distinction, paired with no lockout, create an ideal environment for targeted brute force or credential stuffing attacks.

This question examines how verbose error messages and missing account lockout policies facilitate credential guessing attacks against web applications. It establishes that the absence of lockout mechanisms combined with informative feedback is the primary vulnerability enabling brute force success.

Common mistake: Test-takers often select SQL Injection (A) or XSS (D) because they are common web vulnerabilities, ignoring the specific contextual clues about authentication mechanics provided in the scenario.

Expert Analysis

Why the Answer Is Correct

The correct answer is B because the scenario explicitly describes two critical weaknesses: the lack of an account lockout policy and verbose error messages. These conditions allow an attacker to systematically guess credentials without being blocked and to verify their guesses instantly based on the server's response. This combination is the textbook definition of a vulnerable setup for a brute force attack.

Why the Other Options Are Wrong

Option A (SQL Injection) is incorrect because there is no evidence of input manipulation points; the focus is on authentication logic. Option C (MitM/Clickjacking) is incorrect because the application already implements headers to prevent clickjacking, and MitM requires network access not mentioned. Option D (XSS) is incorrect because while CSP is missing, the immediate exploitable weakness described relates to authentication failure handling, not script injection.

Community Comment Notes

The community consensus strongly supports option B, with users noting that the lack of lockout and detailed errors makes brute force the logical choice. Comments highlight that these specific misconfigurations are direct enablers for credential guessing techniques.

Exam Strategy

Always map the symptoms in the question stem to the attack vector. If you see 'no lockout' and 'verbose errors', think 'Brute Force' or 'Credential Stuffing'. Do not assume other complex attacks unless specific technical indicators (like SQL syntax errors or script tags) are present.

Frequently Asked Questions

Why isn't SQL Injection the best choice here?

SQL Injection requires inputs that interact with database queries. The scenario focuses on authentication feedback and lockout policies, which are irrelevant to SQLi.

Does missing CSP enable brute force?

No. Missing CSP enables Cross-Site Scripting (XSS). Brute force is enabled by the lack of account lockout and verbose error messages during login attempts.

More 312-50v12 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. insaniunt 👍 2 Answered B
    B. The tester could execute a Brute Force attack, leveraging the lack of account lockout policy and the verbose error messages to guess the correct credentials.
  2. LordXander 👍 1 Answered B
    Because there's no account lockout mecanism and have detailed information whatever the username or password is wrong, the brute force method makes the most sense B
  3. xbsumz 👍 1
    Could someone confirm the accuracy of this CEH technique

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide