• hamster@kbin.social
    link
    fedilink
    arrow-up
    48
    ·
    1 year ago

    https://owasp.org/www-community/attacks/Credential_stuffing

    Credential stuffing is the automated injection of stolen username and password pairs (“credentials”) in to website login forms, in order to fraudulently gain access to user accounts.

    Since many users will re-use the same password and username/email, when those credentials are exposed (by a database breach or phishing attack, for example) submitting those sets of stolen credentials into dozens or hundreds of other sites can allow an attacker to compromise those accounts too.

    • doppelgangmember@lemmy.world
      link
      fedilink
      arrow-up
      1
      ·
      edit-2
      1 year ago

      So they brute forced the login?

      No request limiting?

      Wtf

      Edit: yeah it’s just a brute force with less steps. That’s fuckn embarrassing “Credential Stuffing is a subset of the brute force attack category. Brute forcing will attempt to try multiple passwords against one or multiple accounts; guessing a password, in other words. Credential Stuffing typically refers to specifically using known (breached) username / password pairs against other websites.”