Credential Stuffing

Description

Credential stuffing is an automated attack that exploits widespread password reuse — testing stolen username/password pairs from one breached service against a different service's login endpoint. Because the majority of users reuse passwords across multiple accounts, credentials leaked from a breach of service A provide a direct attack path into service B, service C, and any other platform where the same email and password combination was used.

The scale of available breach data makes this attack highly practical. The Have I Been Pwned database contains over 12 billion compromised credentials from thousands of breaches. Dedicated credential stuffing marketplaces sell fresh breach compilations. Attackers use specialized tools — Sentry MBA, OpenBullet, SilverBullet, and STORM — that are specifically designed to test large credential lists at high velocity against HTTP login endpoints, including those protected by Cloudflare and similar services.

Credential stuffing falls under CWE-307 (Improper Restriction of Excessive Authentication Attempts) and OWASP A07:2021 (Identification and Authentication Failures). Its success rate is typically 0.1–2% of tested credentials, which sounds low but translates to thousands of compromised accounts when testing millions of credential pairs — representing a systematic and ongoing threat to any application with a large user base.

How It Works

The attacker acquires a credential list (e.g., Collection #1 — 2.7 billion email/password pairs), configures a stuffing tool with the target site's login request format, and launches the attack:

OpenBullet 2 configuration (commonly found in threat intelligence):

[Target]
URL = https://target.com/api/login
Method = POST
Content-Type = application/json
Body = {"email":"<USER>","password":"<PASS>"}

[KeyCheck]
Success = "token" (check response body contains authentication token)
Failure = "Invalid credentials"

The tool rotates through a proxy pool (residential proxies are preferred to evade IP-based blocking) and tests credentials at hundreds or thousands per minute.

Detection by the attacker — successful stuffing is identified by:

• Login response containing session token or user profile data
• Redirect to authenticated dashboard (HTTP 302 to /home)
• Response body containing username or account information

Realistic attack sequence for a mid-size application:

1. Attacker obtains a breach compilation containing 50 million email/password pairs
2. Configures OpenBullet with the target's login endpoint format
3. Routes traffic through a residential proxy network to avoid IP blocking
4. Tests at 500 req/min across 10,000 IPs — undetectable per-IP rate limiting
5. Achieves a 0.5% success rate — 250,000 compromised accounts
6. Sells valid credentials, accesses payment methods, or monetizes account access directly

Mobile API credential stuffing — mobile app APIs often have weaker rate limiting than web endpoints. Attackers use emulators or real device farms to bypass device fingerprinting, mimicking legitimate app traffic.

Impact

• Mass Account Takeover — Thousands to millions of accounts compromised per campaign against large applications
• Financial Fraud — Unauthorized purchases, payment method theft, and gift card draining from compromised accounts
• Data Breach Amplification — Each stuffed account leaks PII, enabling follow-on phishing and identity theft
• Account Resale — Compromised accounts sold on dark web marketplaces or used to access connected services
• Reputational Damage — Mass account takeover events generate press coverage and regulatory scrutiny

Detection

Testing for susceptibility to credential stuffing from a penetration testing perspective:

1. Test login rate limiting — submit 20+ login attempts with incorrect credentials from a single IP. Document whether rate limiting, CAPTCHA, or lockout is triggered and at what threshold.
2. Test distributed rate limit bypass — rotate through multiple IP addresses (use Burp Suite with different proxy settings) and verify whether the rate limit is per-IP or global.
3. Test with known-breached credentials — using test accounts you control, verify whether breach credential checking (HIBP Pwned Passwords API) is implemented at registration. An application that allows passwords from known breaches has higher stuffing exposure.
4. Test for device fingerprinting — submit login requests from multiple User-Agents and device fingerprints. A robust defense should detect and challenge sessions where the device fingerprint doesn't match historical patterns.
5. Verify MFA enrollment rate — assess what percentage of users have MFA enabled. A low MFA enrollment rate combined with weak rate limiting significantly amplifies credential stuffing risk.
6. Check for Sec-Fetch-Site / Sec-Fetch-Mode validation — verify whether the API validates browser-sent security fetch metadata headers that automated tools often omit.

Remediation

Implement MFA. This is the single most effective defense against credential stuffing. Even a stuffed credential pair fails if the account requires a TOTP code or push notification.

Check passwords against breach databases. At login, verify the submitted password against the HIBP Pwned Passwords API using k-anonymity. Alert or force-reset accounts using known-breached passwords:

async function checkPwnedPassword(password) {
  const hash = sha1(password).toUpperCase();
  const prefix = hash.slice(0, 5);
  const response = await fetch(`https://api.pwnedpasswords.com/range/${prefix}`);
  const hashes = await response.text();
  return hashes.includes(hash.slice(5));
}

Deploy device fingerprinting and behavioral analysis. Use a combination of browser fingerprint, request header patterns, and login velocity to identify non-human traffic patterns. Tools like Shape Security (now F5), Cloudflare Bot Management, and Akamai Bot Manager provide commercial detection.

Implement adaptive authentication. Trigger CAPTCHA or step-up authentication (SMS/email OTP) for logins exhibiting suspicious patterns: new device, new location, velocity anomaly, or breach credential match.

Monitor for stuffing-pattern telemetry. Alert on: high authentication failure rates (>10% per hour), login velocity spikes, credential pair reuse across multiple accounts, and access from hosting/proxy ASNs.