Weak rate limit could lead to ATO due to weak password protection mechanisms
该报告还没有中文解读。
原文摘录
摘自原文（3728 字符中的一小部分）
Summary: Although the server sends a message when attempting to brute force the login endpoint, if you enter the right credentials the server will ignore that error and will give access to the account. **When the server sends this error, it should not give access until the 3400+ seconds ends** …
原文中的代码
HTTP/1.1 200 OK Date: Wed, 23 Dec 2020 14:40:53 GMT Content-Type: application/json; charset=utf-8 Connection: close Set-Cookie: __cfduid=d191afcbe4c1251f6b30748328b1fb38e1608734453; expires=Fri, 22-Jan-21 14:40:53 GMT; path=/; domain=.dubsmash.com; HttpOnly; SameSite=Lax; Secure X-Powered-By: …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Reddit 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @bombon · 版权归作者与 Reddit 所有