HexBrain

IRCCloud · Report #6883

Bruteforcing irccloud login

Validstatus
$100bounty
3upvotes
26 May 2014disclosed

How it was found

There is no mitigation, defenses in anyway or a lockout mechanism in the login page. A malicious minded user can continually tries to brute force an account password.

I have tried to input 20 incorrect password and I have not been lockout, tried the corrct password in the 21st time and it login successfully.

Kindly take a look sir. kindly also let me know if you needed more information.

Clifford

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original