Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-athn-03
Testing for Weak Lock Out Mechanism
Passed 18 of 22 test cases with the skill, and 17 of 22 without it.
1 fixed17 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
A test case the skill fixed. Same model, same prompt, with and without the skill.
What is the CVSS v3 score and severity level assigned when an account lockout mechanism can be bypassed by spoofing or rotating IP addresses?
| Checked | Without skill | With skill |
|---|---|---|
| Assigns a CVSS v3 score of 6.5. | Missed | Passed |
| Classifies the IP bypass severity as Medium. | Passed | Passed |
The instructions your model reads when the skill loads.
WSTG-ATHN-03
Testing for Weak Lock Out Mechanism
Account lockout mechanisms are designed to protect against brute-force password attacks by temporarily or permanently locking accounts after a certain number of failed login attempts. This test evaluates whether the lockout mechanism is properly implemented and cannot be bypassed. Weak or missing lockout mechanisms allow attackers to perform unlimited password guessing attempts.
| Technique | Description |
|---|---|
| IP rotation | Different IPs reset counter |
| Session rotation | New sessions reset counter |
| Username variation | Case changes bypass counter |
| Simultaneous attacks | Race conditions |
| Alternative endpoints | Different login paths |
test cases passed, vs 17 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.