WebCrack: Dynamic Dictionary Adjustment for Web Weak Password Detection based on Blasting Response Event Discrimination
Xiang Long, Yan Huang, Zhendong Liu, Lansheng Han, Haili Sun, Jingyuan, He

TL;DR
WebCrack is a system that dynamically adjusts password dictionaries based on web response analysis to improve weak password detection accuracy across diverse web platforms.
Contribution
The paper introduces a novel multi-factor correlation detection method with dynamic dictionary adjustment for web weak password detection.
Findings
Achieved an average detection accuracy of 93.75%.
Effectively discriminates blasting failure events.
Demonstrated applicability on multiple web systems.
Abstract
The feature diversity of different web systems in page elements, submission contents and return information makes it difficult to detect weak password automatically. To solve this problem, multi-factor correlation detection method as integrated in the DBKER algorithm is proposed to achieve automatic detection of web weak passwords and universal passwords. It generates password dictionaries based on PCFG algorithm, proposes to judge blasting result via 4 steps with traditional static keyword features and dynamic page feature information. Then the blasting failure events are discriminated and the usernames are blasted based on response time. Thereafter the weak password dictionary is dynamically adjusted according to the hints provided by the response failure page. Based on the algorithm, this paper implements a detection system named WebCrack. Experimental results of two blasting tests…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAdvanced Malware Detection Techniques · Network Security and Intrusion Detection · User Authentication and Security Systems
