Credential stuffing is used to perform account takeover attacks through automated injection of breached username/password pairs. This method uses stolen email and password logins from other sources to gain unauthorized access to accounts. Attackers leverage large numbers of leaked credentials in an automated fashion against numerous websites, in an attempt to take over user accounts with credential reuse. The attacker acquires these spilled usernames and passwords from a website breach, and uses an account checker (such as SentryMBA) to test the stolen credentials against many websites. Successful logins allow the attacker to take over the account matching the stolen credentials.
The Barracuda ABP system uses a cloud-based database of breached credentials to validate incoming login requests. When a match for the incoming credentials is found, the Barracuda Web Application Firewall is configured to alert the admin and / or block such login requests.
The BOT MITIGATION > Bot Mitigation page allows you to enable Credential Stuffing Protection.
- On the BOT MITIGATION > Bot Mitigation page, click Edit in the Options column next to the desired Bot Mitigation policy. Next, configure the following values:
- Username – Specifies the username field in the web page from which the actual username can be extracted by the Barracuda Web Application Firewall.
- Password – Specifies the password field in the web page from which the actual password can be extracted by the Barracuda Web Application Firewall.
- Click Save.