Bugtraq mailing list archives

Re: Write-only devices (Was read only devices)


From: weave () hopi dtcc edu (Ken Weaverling)
Date: Thu, 27 Jun 1996 12:24:29 -0400


On Thu, 27 Jun 1996, J.R.Valverde (jr) wrote:

        FTP: failed login attempt for user "pAsSwOrD"
        FTP: successful login for user "user" two seconds later

I always wondered why the heck this happens. While knowing what account is
being attempted is valuable, why the heck doesn't the code just try and
see if pAsSwOrD is a valid account name?  If it isn't, don't display it
or say "failed login attempt for an undefined system user."

If the attempt was to a valid account name, then record that info. If one
of your users is using another account name as a password,  your obviously
not appending your list of user account names to your Crack dictionary.



Current thread: