Technical Tip: Enable Credential Stuffing Defense in User Tracking Policy

[shafiq23]

Description	This article describes how to configure and enable Credential Stuffing Defense in Use Tracking Policy.
Scope	FortiWeb, FortiWeb-VM.
Solution	Requirement: Valid Credential Stuffing Defense Contract. Database synchronized via FortiGuard. From GUI: Navigate to Tracking -> User Tracking. Select Create New. Input required settings (Host, Authentication URL, Username/Password Field, etc.). Enable 'Credential Stuffing Defense' and 'Credential Stuffing Online Check'. Set action (Alert, Alert&Deny, Deny(no log), Redirect, Block Period). Select OK. The test button allows users to test the local and online Credential Stuffing Defense database. Enter suspected malicious credentials to verify. More information related to User Tracking rule in the documentation. FortiWeb Administration Guide - Tracking  Note: Credential Stuffing Defense is not supported in offline mode. Steps to verify: Browse to the protected login URL. For example: https://dvwa.ftntlab.local/login.php. Use possibly malicious user credentials to log in. For example: admin/admin123. Request will be blocked by FortiWeb.                             Attack log generated. Verify in Log&Report -> Log Access -> Attack.