An attacker is testing out the login page of a website. He notices that after 5 failed attempts he is redirected to a different page. He assumes this logs his IP address, and if this redirect continues, it could lead to being blocked.
How can he avoid this from happening?
A) He can turn on SSL support in his browser, that way the encrypted requests will be hidden from the
IDS
B) He can send his requests from random spoofed IPs so the server wouldn't think they are all coming from the same source
C) He can create a persistant cookie that tells the web server to ignore failed logins
D) If there is a hidden form field that stores the "retries" count, he can modify the source code to avoid the threshold

Question

Quizplus · Accepted Answer

Hidden form fields might also get mentioned in the context of changing prices on an order form although that vulnerability is extremely rare (we hope). Changing hidden form fields for a variety of reasons is still very much a threat. They must be used carefully.

An Attacker Is Testing Out the Login Page of a Website