Unit 7: Logins, MFA and tokens · Lesson 3 of 7 · 18 min
Rate limits and multi-factor
Slow down guessing at the door, and make a stolen password not enough.
mission
- You are
- The analyst reviewing the shop's sign-in.
- Situation
- Credential stuffing, where attackers replay leaked passwords from other breaches, is the top cause of account takeover at online shops.
- Goal
- Check how the shop reacts to repeated wrong passwords for one account.
- Hand in
- The limit, the status code and the wait the shop imposes.
Layers that stop password guessing
- Per-account limitStops many guesses at one account
- Limits by address and across accountsStops a few guesses at many accounts
- Breached password checkRefuses passwords already leaked elsewhere
- MFA or passkeysA right password alone is not enough
Six wrong tries
for i in 1 2 3 4 5 6; do curl -s -o /dev/null -w '%{http_code}\n' -d 'user=tester&password=guess' http://127.0.0.1:8000/login; done
401
401
401
401
401
429
you should see Five 401s, then 429 Too Many Requests.
Read the limit
curl -si -d 'user=tester&password=guess' http://127.0.0.1:8000/login | grep -iE '^(HTTP|retry-after)'
HTTP/1.1 429 Too Many Requests
Retry-After: 60
you should see A Retry-After header tells the client how long to wait.
defender tip Limits per account stop guessing at one user. Stuffing spreads guesses over thousands of accounts, so also limit per address and watch for many accounts failing from one source.
Other accounts are not affected
curl -s -o /dev/null -w '%{http_code}\n' -d @shop-account.txt http://127.0.0.1:8000/login
303
you should see 303. The lock is per account, so a guesser cannot lock everyone out at once.
Try a different account
The limit counts failures per account. Check whether another account is affected while tester is locked.
curl -s -o /dev/null -w '%{http_code}\n' -d 'user=someone&password=guess' http://127.0.0.1:8000/login
401
you should see 401, not 429. The limit protects each account but does nothing against a few tries on many accounts. The credential stuffing case file shows why that matters.
A login review checklist
| Command | What it does |
|---|---|
Rate limit | Per account and per address, then 429 with Retry-After |
Same error for every failure | Wrong user and wrong password look identical |
Multi-factor | Required for staff, offered to customers |
Phishing-resistant factors | Passkeys or security keys beat codes by text message |
Breached password check | Refuse passwords known from public breaches |
What a defender takes away
- 1Rate limits turn millions of guesses into a handful.
- 2MFA makes a correct password alone not enough.
- 3Text message codes can be phished; passkeys cannot.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.