Credential stuffing: bots replaying stolen passwords
Contents
Share
Credential stuffing is a mass of sign-in attempts that test whether stolen name-and-password pairs still work. The pairs may come from another application, a criminal market, or a public leak. There is no guessing: the values were already used. This is not click fraud. A click on an ad does not submit a password.
If failed sign-ins rise on the same passwords people used on other sites, you are looking at stuffing, not at a dictionary started from zero.
Three attacks on sign-in
OWASP separates three attacks. Cracking is many passwords against one account. Credential stuffing is testing pairs leaked from another site. Spraying is one weak password across many accounts. OWASP calls a second factor the best defense against most of these attacks.
A figure for “what share of compromises a second factor would have stopped” is not used here: the text gives it as a Microsoft analysis with no year and no sample.
The OAT-008 catalog entry adds the three sources of pairs and a direct refusal of guessing. Unlike OAT-007, the values are not enumerated. The catalog does not publish a success rate, so a spike of failed sign-ins cannot be turned into “this many accounts are already taken” without your own sample. How the lists are obtained is outside this description.
Report shares are not the share of your sign-ins
Imperva’s report on 2024 data says about 44% of advanced bot traffic was aimed at APIs and about 10% at web applications. In the breakdown of bot attacks on APIs, data collection is about 31%, payment fraud about 26%, account takeover about 12%, and scalping about 11%. Those are shares in a breakdown of API attacks on Imperva’s customer network, vendor data. They are not a share of a shop’s orders and not a share of successful password guesses. The 12% account-takeover share is not the success rate of credential stuffing on your sign-in form.
In the same place the report describes scalping as quickly buying or reserving a large volume of scarce goods and services. That is not about password pairs. Do not carry the takeover percentage onto the sign-in form.
A WAF and a bot product are different write-ups
The Cloudflare WAF overview says the WAF inspects incoming requests to the site and the API and filters unwanted traffic with rulesets: address, path, headers, body. The capability table lists leaked-credential detection on every plan. The overview does not name the database the check uses. Its last line sends bots to separate bot solutions.
The bot-solutions overview says bots — automated programs that send requests to a site — can lift content, submit stolen passwords into sign-in forms, buy out stock, and inflate server cost. The bot products detect that automated traffic and leave the response decision to the owner.
Both pages are about Cloudflare products. They do not say that a WAF or a bot product subtracts clicks in an ad account. Detecting a leaked pair at sign-in and an invalid click are different decisions. Who clicks ads, how click fraud differs from sklikivanie, and whether Yandex returns the money are not decided by the password form.
What to do at sign-in:
Name the event. Many passwords against one account is cracking. One weak string across many accounts is spraying. Ready-made pairs from another site is stuffing.
Put a second factor against most of these attacks, as OWASP recommends. Do not expect a “nearly all compromises” figure without your own sample.
Do not read the 12% in the Imperva report as the share of your customers who were taken over.
If you use Cloudflare, keep the split in mind: the WAF filters a request with rules and, on every plan, flags leaked credentials without naming the database. The docs place the reaction to bots in separate bot solutions and leave the decision to the owner.
Do not expect the sign-in filter to refund an advertising click.
Take one night of failed sign-ins and do not mix the three attacks. Many different passwords against one account is cracking. The same weak password against many accounts is spraying. Pairs that match what people used on another site is stuffing: the catalog explicitly refuses guessing and names three sources — another application, a criminal market, a public leak. Those three pictures do not fold into one basket called “brute force,” and OWASP places a second factor against most of all of them, not against one.
The 2024 report is useful as someone else’s breakdown, not as your plan. About 44% of advanced bot traffic on APIs and about 10% on web applications, then inside the API slice data collection, payment fraud, account takeover, and scalping, are shares of attacks on Imperva’s customer network. Takeover at about 12% does not mean 12% of your buyers already signed in with someone else’s password. Scalping at about 11% in the same table is a fast purchase of scarce goods. A factor on the sign-in form does not treat it.
If the site uses Cloudflare, do not glue the two overviews together. The WAF looks at address, path, headers, and body, and on every plan it can flag leaked credentials without naming the database. The WAF overview sends bots to separate bot solutions. Those detect automated requests, including stolen passwords submitted into sign-in forms, and leave the reaction to the owner. Neither overview says an advertising click is refunded because of that.