The Ravens’ login gate does not limit the number of attempts, it openly says whether a username exists, and the leader’s password is a weak, common one. The username is admin.
The Ravens login gate is a sign-in form. Passwords are weak and common, there is no attempt limit, and the error messages reveal whether a user exists. The admin account is your target.
Log in as admin by guessing his weak password.
You logged in as admin with a weak password and no attempt limit.
Why the solution worked
Several authentication weaknesses met here: a weak, common password; no limit on attempts (no rate limiting, no lockout); and error messages that reveal whether the user exists. Guessing becomes easy. The fix: require strong passwords and block common ones, limit attempts (progressive delay or a temporary lockout), give one identical error for every failure, and add two-factor authentication for important accounts.
The root cause
Three problems combine: a weak password, no attempt limit, and error messages that distinguish a missing user from a wrong password, which eases user enumeration and guessing.
How the code is fixed
Three layers: strong passwords hashed with bcrypt, a limit on attempts, one uniform error message, then two-factor authentication.
Vulnerable code
app.post('/login', (req, res) => {
const user = db.user(req.body.username);
if (!user) return res.json({ ok: false, error: 'No such user' }); // enumeration
// No rate limit, no lockout, weak password allowed.
if (user.password === req.body.password) { login(res, user); return res.json({ ok: true }); }
res.json({ ok: false, error: 'Wrong password' }); // different message
});
Safe code
app.post('/login', rateLimit({ max: 5, per: '15m', lockout: true }), async (req, res) => {
const user = db.user(req.body.username);
const ok = user && await bcrypt.compare(req.body.password, user.hash);
if (!ok) return res.json({ ok: false, error: 'Invalid username or password' }); // one message
login(res, user); // plus 2FA for privileged accounts
res.json({ ok: true });
});
Impact in the real world
Automated credential stuffing and brute force break accounts with weak or leaked passwords, and are among the top causes of account compromise in the real world.
How defenders detect it
Defenders alert on many failed logins from one source or against one account, use a single uniform error message, and enforce rate limiting and MFA.
