Credential stuffing
Credential stuffing is an automated attack that tests username-and-password pairs exposed by previous breaches against other services to gain unauthorized account access.
Secure APIs
Credential stuffing is an attack that tries leaked username-and-password pairs against other services to take over accounts.
- How it is used
- Frames credential stuffing as a broken-authentication attack that threatens account takeover.
- How deep it goes
- Defines the attack and its reuse pattern, then connects it to brute-force exposure without detailing implementation controls.
- Examples
- Uses leaked credentials from one website inserted into another website’s API as the central attack example.
- What you can do after
- Evaluate login defenses by recognizing credential reuse and unrestricted repeated authentication attempts as takeover risks.
The Art of Code
Credential stuffing is an automated attack that tests leaked username and password pairs against other services.
- How it is used
- Flags repeated invalid-credential submissions as a security event requiring logging, monitoring, and immediate response.
- How deep it goes
- Defines leaked credential-pair reuse and identifies its warning sign, but does not detail detection or mitigation techniques.
- Examples
- Uses repeated invalid credentials submitted through a login form as the concrete warning sign.
- What you can do after
- Diagnose suspicious login failures by recognizing credential stuffing as an actionable event for logging and monitoring.
Grokking Web Application Security
A credential-stuffing attack tests large collections of previously stolen username-and-password pairs against a targeted service.
- How it is used
- Frames credential stuffing as a practical consequence of stolen credentials and password reuse.
- How deep it goes
- Defines the attack and distinguishes password spraying, but does not describe implementation, detection, or mitigation.
- Examples
- Uses stolen credential databases, compromised Facebook accounts, scammers, and an uncle promoting fraudulent sunglasses.
- What you can do after
- Evaluate/understand how stolen credential collections can compromise accounts on a targeted service.
Read how Grokking Web Application Security explains credential stuffing →
Related concepts
- stolen credentialuses · A stolen credential is an account identifier or authentication secret obtained without the account holder’s authorization.
- WebAuthnaddressed by · WebAuthn is a web authentication standard and browser API that enables public-key authentication using credentials managed by platform or external authenticators.
- credential managementuses · Credential management is the controlled administration of authentication credentials, including their provisioning, storage, protection, validation, rotation, and revocation.
- multifactor authenticationaddressed by · Multifactor authentication is an authentication method that verifies identity using evidence from at least two distinct authentication-factor categories.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.