| Nature | Type | ID | Name |
|---|---|---|---|
| ChildOf | M | 212 | Functionality Misuse |
Lock Out Accounts
Perform lockout procedure for all accounts that the attacker wants to lock out.
| Technique |
|---|
| For each user ID to be locked out, perform the lockout procedure discovered in the first step. |
Investigate account lockout behavior of system
Investigate the security features present in the system that may trigger an account lockout
| Technique |
|---|
| Analyze system documentation to find list of events that could potentially cause account lockout |
| Obtain user account in system and attempt to lock it out by sending malformed or incorrect data repeatedly |
| Determine another user's login ID, and attempt to brute force the password (or other credentials) for it a predetermined number of times, or until the system provides an indication that the account is locked out. |
Obtain list of user accounts to lock out
Generate a list of valid user accounts to lock out
| Technique |
|---|
| Obtain list of authorized users using another attack pattern, such as SQL Injection. |
| Attempt to create accounts if possible; system should indicate if a user ID is already taken. |
| Attempt to brute force user IDs if system reveals whether a given user ID is valid or not upon failed login attempts. |
No programming skills or computer knowledge is needed. An attacker can easily use this attack pattern following the Execution Flow above.
| Scope | Likelihood | Impact | Note |
|---|---|---|---|
| Availability | N/A | Resource Consumption | Denial of Service |
| Taxonomy Name | Entry ID | Entry Name |
|---|---|---|
| ATTACK | 1531 | Account Access Removal |