wstg-athn-03

name	wstg-athn-03
description	Testing for Weak Lock Out Mechanism
category	authentication
owasp_id	WSTG-ATHN-03
version	1.0.0
author	cyberstrike-official
tags	["authentication","login","credentials","mfa","wstg","athn"]
tech_stack	[]
cwe_ids	["CWE-304"]
chains_with	[]
prerequisites	[]
severity_boost	{}

wstg-athn-03

Test ID

WSTG-ATHN-03

Test Name

Testing for Weak Lock Out Mechanism

High-Level Description

Account lockout mechanisms are designed to protect against brute-force password attacks by temporarily or permanently locking accounts after a certain number of failed login attempts. This test evaluates whether the lockout mechanism is properly implemented and cannot be bypassed. Weak or missing lockout mechanisms allow attackers to perform unlimited password guessing attempts.

---

What to Check

Lockout Implementation

• Lockout threshold exists
• Lockout duration appropriate
• Lockout applies to all authentication methods
• Lockout cannot be bypassed
• Account enumeration via lockout
• Denial of service via lockout

Bypass Techniques

Technique	Description
IP rotation	Different IPs reset counter
Session rotation	New sessions reset counter
Username variation	Case changes bypass counter
Simultaneous attacks	Race conditions
Alternative endpoints	Different login paths

---

How to Test

Step 1: Determine Lockout Threshold

#!/bin/bash
TARGET="https://target.com/api/login"
USERNAME="testuser"

echo "Testing lockout threshold..."

for i in {1..20}; do
    response=$(curl -s -X POST "$TARGET" \
        -H "Content-Type: application/json" \
        -d "{\"username\":\"$USERNAME\",\"password\":\"wrongpass$i\"}")

    echo "Attempt $i: $response"

    # Check for lockout indicators
    if echo "$response" | grep -qi "locked\|blocked\|too many"; then
        echo "[+] Account locked after $i attempts"
        break
    fi
done

Step 2: Test Lockout Duration

#!/bin/bash
# After account is locked, test how long until it unlocks

TARGET="https://target.com/api/login"
USERNAME="testuser"
CORRECT_PASSWORD="correctpassword"

# First, lock the account
for i in {1..10}; do
    curl -s -X POST "$TARGET" \
        -H "Content-Type: application/json" \
        -d "{\"username\":\"$USERNAME\",\"password\":\"wrong\"}" > /dev/null
done

echo "Account should be locked. Testing unlock timing..."

# Test every minute
for minute in {1..30}; do
    sleep 60
    response=$(curl -s -X POST "$TARGET" \
        -H "Content-Type: application/json" \
        -d "{\"username\":\"$USERNAME\",\"password\":\"$CORRECT_PASSWORD\"}")

    if echo "$response" | grep -qi "success\|token"; then
        echo "[+] Account unlocked after $minute minutes"
        break
    else
        echo "Minute $minute: Still locked"
    fi
done

Step 3: Test IP-Based Bypass

#!/bin/bash
# Test if lockout is per-IP or per-account

TARGET="https://target.com/api/login"
USERNAME="testuser"

# Use different X-Forwarded-For headers
ips=("1.1.1.1" "2.2.2.2" "3.3.3.3" "4.4.4.4" "5.5.5.5")

for ip in "${ips[@]}"; do
    for i in {1..10}; do
        curl -s -X POST "$TARGET" \
            -H "Content-Type: application/json" \
            -H "X-Forwarded-For: $ip" \
            -d "{\"username\":\"$USERNAME\",\"password\":\"wrong$i\"}" > /dev/null
    done
    echo "Sent 10 attempts from $ip"
done

# Now test if account is locked
response=$(curl -s -X POST "$TARGET" \
    -H "Content-Type: application/json" \
    -d "{\"username\":\"$USERNAME\",\"password\":\"wrongtest\"}")

if echo "$response" | grep -qi "locked"; then
    echo "[+] Account is locked (proper implementation)"
else
    echo "[!] Account not locked - IP-based lockout may be bypassable"
fi

Step 4: Test Session-Based Bypass

#!/bin/bash
TARGET="https://target.com/login"
USERNAME="testuser"

# Try multiple sessions
for session in {1..5}; do
    echo "Session $session..."

    for i in {1..5}; do
        curl -s -X POST "$TARGET" \
            -H "Content-Type: application/x-www-form-urlencoded" \
            -c cookies_$session.txt \
            -b cookies_$session.txt \
            -d "username=$USERNAME&password=wrong$i" > /dev/null
    done

    rm cookies_$session.txt
done

# Test if still locked
response=$(curl -s -X POST "$TARGET" \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -d "username=$USERNAME&password=test")

echo "Final response: $response"

Step 5: Test Username Variation Bypass

#!/bin/bash
TARGET="https://target.com/api/login"

# Test username case sensitivity
usernames=("admin" "Admin" "ADMIN" "aDmIn" " admin" "admin ")

for username in "${usernames[@]}"; do
    for i in {1..5}; do
        curl -s -X POST "$TARGET" \
            -H "Content-Type: application/json" \
            -d "{\"username\":\"$username\",\"password\":\"wrong$i\"}" > /dev/null
    done
    echo "Sent 5 attempts for: '$username'"
done

# Total: 30 attempts if all treated as same user
# Check if any version is locked
for username in "${usernames[@]}"; do
    response=$(curl -s -X POST "$TARGET" \
        -H "Content-Type: application/json" \
        -d "{\"username\":\"$username\",\"password\":\"test\"}")

    echo "'$username': $response" | head -c 100
    echo ""
done

Step 6: Test Alternative Login Endpoints

# Test if lockout applies to all login methods

endpoints=(
    "/login"
    "/api/login"
    "/api/v1/login"
    "/api/v2/auth"
    "/oauth/token"
    "/auth/login"
    "/mobile/login"
)

USERNAME="testuser"

# Lock account on main endpoint
for i in {1..10}; do
    curl -s -X POST "https://target.com/login" \
        -d "username=$USERNAME&password=wrong" > /dev/null
done

# Try other endpoints
for endpoint in "${endpoints[@]}"; do
    response=$(curl -s -X POST "https://target.com$endpoint" \
        -H "Content-Type: application/json" \
        -d "{\"username\":\"$USERNAME\",\"password\":\"test\"}" \
        -w "\n%{http_code}")

    echo "$endpoint: $response" | tail -2
done

Step 7: Test Account Lockout Enumeration

#!/bin/bash
# Test if lockout behavior reveals valid accounts

TARGET="https://target.com/api/login"

# Test with valid username
echo "Testing with potentially valid username..."
for i in {1..10}; do
    curl -s -X POST "$TARGET" \
        -H "Content-Type: application/json" \
        -d '{"username":"admin","password":"wrong"}' > /dev/null
done

valid_response=$(curl -s -X POST "$TARGET" \
    -H "Content-Type: application/json" \
    -d '{"username":"admin","password":"wrong"}')

# Test with invalid username
echo "Testing with invalid username..."
for i in {1..10}; do
    curl -s -X POST "$TARGET" \
        -H "Content-Type: application/json" \
        -d '{"username":"definitelynotauser12345","password":"wrong"}' > /dev/null
done

invalid_response=$(curl -s -X POST "$TARGET" \
    -H "Content-Type: application/json" \
    -d '{"username":"definitelynotauser12345","password":"wrong"}')

echo "Valid username response: $valid_response"
echo "Invalid username response: $invalid_response"

# If responses are different, accounts can be enumerated

---

Tools

Brute Force Testing

Tool	Description	Usage
Hydra	Fast brute-forcer	hydra -l admin -P wordlist.txt target http-post
Burp Intruder	Request repeater	Test lockout behavior
Custom scripts	Targeted testing	Control timing and sources

Analysis

Tool	Description
Burp Suite	Response comparison
OWASP ZAP	Automated scanning

---

Example Commands/Payloads

Lockout Testing Script

#!/usr/bin/env python3
import requests
import time
from concurrent.futures import ThreadPoolExecutor

class LockoutTester:
    def __init__(self, login_url, username):
        self.url = login_url
        self.username = username
        self.results = {}

    def attempt_login(self, password, headers=None):
        """Single login attempt"""
        try:
            response = requests.post(
                self.url,
                json={"username": self.username, "password": password},
                headers=headers or {},
                timeout=10
            )
            return response.status_code, response.text
        except Exception as e:
            return None, str(e)

    def find_lockout_threshold(self, max_attempts=30):
        """Find number of attempts before lockout"""
        print(f"Finding lockout threshold for {self.username}...")

        for i in range(1, max_attempts + 1):
            status, text = self.attempt_login(f"wrongpassword{i}")

            if "locked" in text.lower() or "too many" in text.lower():
                self.results["threshold"] = i
                print(f"[+] Lockout after {i} attempts")
                return i

            time.sleep(0.5)  # Small delay

        self.results["threshold"] = f">{max_attempts}"
        print(f"[!] No lockout after {max_attempts} attempts")
        return None

    def test_ip_bypass(self, attempts_per_ip=5):
        """Test if X-Forwarded-For bypasses lockout"""
        print("Testing IP-based bypass...")

        fake_ips = [f"10.0.0.{i}" for i in range(1, 11)]

        for ip in fake_ips:
            for i in range(attempts_per_ip):
                self.attempt_login(
                    f"wrong{i}",
                    headers={"X-Forwarded-For": ip}
                )

        # Test if account is now locked
        status, text = self.attempt_login("test")

        if "locked" in text.lower():
            self.results["ip_bypass"] = False
            print("[+] IP bypass NOT possible - lockout is per-account")
        else:
            self.results["ip_bypass"] = True
            print("[!] IP bypass MAY be possible")

    def test_concurrent_bypass(self, num_threads=10):
        """Test race condition in lockout"""
        print("Testing concurrent request bypass...")

        def attempt():
            return self.attempt_login("wrongpassword")

        with ThreadPoolExecutor(max_workers=num_threads) as executor:
            futures = [executor.submit(attempt) for _ in range(50)]
            results = [f.result() for f in futures]

        # Check final state
        success_count = sum(1 for s, t in results if s == 200 and "locked" not in t.lower())

        self.results["concurrent_bypass"] = success_count > 10
        print(f"Successful attempts during race: {success_count}")

    def test_username_variation(self):
        """Test if username case affects lockout"""
        print("Testing username variation bypass...")

        variations = [
            self.username,
            self.username.upper(),
            self.username.lower(),
            self.username.capitalize(),
            f" {self.username}",
            f"{self.username} "
        ]

        for var in variations:
            for i in range(3):
                requests.post(
                    self.url,
                    json={"username": var, "password": f"wrong{i}"},
                    timeout=10
                )

        # Test original username
        status, text = self.attempt_login("test")

        if "locked" in text.lower():
            self.results["username_bypass"] = False
            print("[+] Username normalization working correctly")
        else:
            self.results["username_bypass"] = True
            print("[!] Username variation may bypass lockout")

    def generate_report(self):
        """Generate test report"""
        print("\n=== LOCKOUT MECHANISM TEST REPORT ===\n")

        for test, result in self.results.items():
            status = "[VULN]" if result is True or result == ">30" else "[OK]"
            print(f"{status} {test}: {result}")

# Usage
tester = LockoutTester("https://target.com/api/login", "testuser")
tester.find_lockout_threshold()
tester.test_ip_bypass()
tester.test_concurrent_bypass()
tester.test_username_variation()
tester.generate_report()

---

Remediation Guide

1. Implement Proper Account Lockout

import redis
from datetime import datetime, timedelta

redis_client = redis.Redis()

class AccountLockout:
    LOCKOUT_THRESHOLD = 5
    LOCKOUT_DURATION = 900  # 15 minutes
    ATTEMPT_WINDOW = 3600  # 1 hour

    def record_failure(self, username):
        """Record failed login attempt"""
        # Normalize username
        username = username.lower().strip()

        key = f"login_attempts:{username}"
        attempts = redis_client.incr(key)

        if attempts == 1:
            redis_client.expire(key, self.ATTEMPT_WINDOW)

        if attempts >= self.LOCKOUT_THRESHOLD:
            self.lock_account(username)
            return True

        return False

    def lock_account(self, username):
        """Lock the account"""
        username = username.lower().strip()
        lock_key = f"account_locked:{username}"
        redis_client.setex(lock_key, self.LOCKOUT_DURATION, datetime.utcnow().isoformat())

        # Log security event
        log_security_event("account_locked", {
            "username": username,
            "locked_until": datetime.utcnow() + timedelta(seconds=self.LOCKOUT_DURATION)
        })

    def is_locked(self, username):
        """Check if account is locked"""
        username = username.lower().strip()
        return redis_client.exists(f"account_locked:{username}")

    def get_remaining_lockout(self, username):
        """Get remaining lockout time in seconds"""
        username = username.lower().strip()
        ttl = redis_client.ttl(f"account_locked:{username}")
        return max(0, ttl)

    def clear_on_success(self, username):
        """Clear attempts on successful login"""
        username = username.lower().strip()
        redis_client.delete(f"login_attempts:{username}")

lockout = AccountLockout()

@app.route('/login', methods=['POST'])
def login():
    username = request.json.get('username', '')
    password = request.json.get('password', '')

    # Check lockout first
    if lockout.is_locked(username):
        remaining = lockout.get_remaining_lockout(username)
        return jsonify({
            "error": "Account temporarily locked",
            "retry_after": remaining
        }), 429

    user = authenticate(username, password)

    if not user:
        locked = lockout.record_failure(username)

        if locked:
            return jsonify({
                "error": "Account locked due to too many failed attempts",
                "retry_after": lockout.LOCKOUT_DURATION
            }), 429

        return jsonify({"error": "Invalid credentials"}), 401

    # Clear attempts on success
    lockout.clear_on_success(username)

    return jsonify({"token": generate_token(user)})

2. Prevent Lockout-Based Enumeration

def login():
    username = request.json.get('username', '')
    password = request.json.get('password', '')

    # Always check lockout, even for non-existent users
    if lockout.is_locked(username):
        # Generic message - don't reveal account existence
        return jsonify({
            "error": "Account temporarily locked",
            "retry_after": lockout.LOCKOUT_DURATION
        }), 429

    user = authenticate(username, password)

    if not user:
        # Record failure even for non-existent users
        # Prevents enumeration via different lockout behavior
        lockout.record_failure(username)

        # Generic error message
        return jsonify({"error": "Invalid credentials"}), 401

    return jsonify({"token": generate_token(user)})

3. Prevent DoS via Lockout

class SmartLockout:
    """Prevent attackers from locking out legitimate users"""

    def record_failure(self, username, ip_address):
        # Track both account and IP
        account_attempts = self.get_account_attempts(username)
        ip_attempts = self.get_ip_attempts(ip_address)

        # If single IP causing all attempts, don't lock account
        if ip_attempts >= 10 and account_attempts < 3:
            # Block IP, not account
            self.block_ip(ip_address)
            return "ip_blocked"

        # Normal lockout
        if account_attempts >= 5:
            self.lock_account(username)
            return "account_locked"

        return "attempt_recorded"

---

Risk Assessment

CVSS Score

Finding	CVSS	Severity
No account lockout	7.5	High
Lockout bypass via IP rotation	6.5	Medium
Lockout bypass via username variation	6.5	Medium
Account enumeration via lockout	5.3	Medium
Very high lockout threshold (>20)	5.3	Medium

---

CWE Categories

CWE ID	Title	Description
CWE-307	Improper Restriction of Excessive Authentication Attempts	Missing/weak lockout
CWE-799	Improper Control of Interaction Frequency	No rate limiting
CWE-204	Observable Response Discrepancy	Enumeration via lockout

---

References

• OWASP WSTG - Testing for Weak Lock Out Mechanism
• OWASP Authentication Cheat Sheet
• NIST Digital Identity Guidelines

---

Checklist

[ ] Lockout threshold identified
[ ] Lockout duration tested
[ ] IP-based bypass tested
[ ] Session-based bypass tested
[ ] Username variation bypass tested
[ ] Alternative endpoints tested
[ ] Race condition tested
[ ] Account enumeration tested
[ ] DoS via lockout considered
[ ] Lockout logging verified
[ ] Unlock mechanism tested
[ ] Findings documented
[ ] Remediation recommendations provided