CyberCertPrepWeb App FundamentalsAuthentication BasicsEASYFree question
What is 'credential stuffing' and how does it differ from a brute-force attack?
- A.Credential stuffing is identical to brute force - trying all character combinations
- B.Credential stuffing targets only administrator accounts; brute force targets all users
- C.Credential stuffing uses known username/password pairs from previous data breaches (not random guesses) to attempt login at other sites, exploiting password reuse. Brute force tries all possible character combinations
- D.Credential stuffing uses SQL injection to retrieve stored credentials
Why C is correct
Credential stuffing leverages the widespread problem of password reuse. Attackers buy breached credential databases (billions of records from past breaches) and test them against other sites. A 0.1% success rate against 1 billion pairs still yields 1 million compromised accounts. Defenses: MFA, breached-password detection (HaveIBeenPwned API on registration/login), rate limiting by account not just IP, and anomaly detection.
Know someone studying for Web App Fundamentals? Send them this one.