Missing Rate-Limiting & Account Lockout

Rate-limiting and lockout are what make online guessing infeasible. Their absence turns a strong-password or OTP requirement into a speed bump.

How it works

With no throttle, an attacker submits thousands of guesses per second against:

• Login — brute force and credential stuffing.
• OTP/2FA verify — a 6-digit code is only a million possibilities; unlimited tries break it in minutes.
• Reset/voucher codes — short tokens fall to enumeration.

Weak implementations are also bypassable: limits keyed only on IP fall to proxy rotation; limits keyed only on username fall to password spraying (one password across many users).

How to test

Script rapid attempts against login and OTP endpoints. Measure when (if ever) you're throttled or locked, and whether the limit is evaded by rotating IPs or spreading across accounts.

Impact

Brute force of passwords and OTPs; large-scale credential stuffing and password spraying.

Defenses

• Throttle and lock by both account and source; add exponential backoff and CAPTCHA on anomalies.
• Strictly limit OTP attempts (e.g. 5) and expire codes; monitor for spraying patterns across accounts.