Everything about Credential stuffing
Cyberattack using mass login requests
Credential stuffing is a type of cyberattack in which the attacker collects stolen account credentials, typically consisting of lists of usernames or email addresses and the corresponding passwords, and then uses the credentials to gain unauthorized access to user accounts on other systems through large-scale automated login requests directed against a web application. Unlike credential cracking, credential stuffing attacks do not attempt to use brute force or guess any passwords – the attacker simply automates the logins for a large number of previously discovered credential pairs using standard web automation tools such as Selenium, cURL, PhantomJS or tools designed specifically for these types of attacks, such as Sentry MBA, SNIPR, STORM, Blackbullet and Openbullet. Wikipedia →
🧭 Start here: a 6-step reading path
- Read the overview: Credential stuffingA 5-minute orientation
- Skim a recent paper: A Method for Prevention to Credential Stuffing Attacks using Post-Quantum TOTP(Time-based One-Time Password)Influential work since 2022
- Read the landmark paper: Is credential stuffing the new phishing?Cited 10 times
- Go sideways: Have I Been Pwned?A closely related topic
- Go sideways: 2012 Yahoo Voices hackA closely related topic
📖 Definitions
Noun A kind of cyberattack in which a large batch of account credentials stolen from one service are tried against another service in an attempt to log in.
🗂️ The subject at a glance
🏆 Landmark papers (most cited)
Is credential stuffing the new phishing?
Credential stuffing: new tools and stolen data drive continued attacks
Credential stuffing – the new hack
PassREfinder-FL: Privacy-preserving credential stuffing risk prediction via graph-based federated learning for representing password reuse between websites
Artificial Intelligence and Advanced Cybersecurity to Mitigate Credential-Stuffing Attacks in the Banking Industry
Leveraging Zero Trust Architectures and Blockchain Protocols to Prevent Credential Stuffing and Lateral Fraud Attacks in Enterprise Systems
Detection of password reuse and credential stuffing: a server-side approach
Unsupervised Detection of Credential Stuffing and Account Takeover Attempts through User Behavioral Biometrics in Web Applications
🆕 Influential since 2022
A Method for Prevention to Credential Stuffing Attacks using Post-Quantum TOTP(Time-based One-Time Password)
A Method for Prevention Credential Stuffing Attacks Using Counting Bloom Filter and Time-Based One-Time Password
Adaptive Anomaly Detection Algorithm for Real-Time Identification of Phishing and Credential Stuffing Attacks in E-Learning Systems Using Deep Reinforcement Learning
📚 Books worth reading
Open Library didn't respond; try again in a moment.
🔗 Related topics
- Have I Been Pwned? Have I Been Pwned? (HIBP) is a website that allows Internet users to check whether their email address or password has been compromised by data breaches…
- 2012 Yahoo Voices hack In July 2012, Yahoo Voice, a user-generated content platform owned by Yahoo, suffered a major data breach. On July 11, 2012, a hacking group calling itself…
- Password manager A password manager is software that stores usernames and passwords in a collection called a password vault. The vault is intended to be encrypted, and…
- Partial password A partial password is a mode of password authentication intended to make keystroke logging and shoulder surfing less effective. By asking the user to enter…
- Troy Hunt Troy Adam Hunt is an Australian web security consultant known for public education and outreach on security topics. He created and operates Have I Been…
- 23andMe data leak The 23andMe data leak was a data breach at personal genomics company 23andMe reported in October 2023. The cyberattack gathered profile and ethnicity informatio…
- Evite Evite is a social-planning website for creating, sending, and managing online invitations. The website offers digital invitations with RSVP tracking. It…
- Single sign-on Single sign-on (SSO) is an authentication scheme that allows a user to log in with a single ID to any of several related, yet independent, software systems…