Credential Stuffing

Credential stuffing replays username/password pairs leaked in third-party breaches against your login, betting on password reuse — no guessing involved, just known-valid combos fired at scale. It’s distinct from brute force (which guesses) and password spraying (one password, many users); phishing is one of the most common sources feeding the harvested pairs in the first place.

How It Works

• Breach combolists — billions of leaked email/password pairs circulate and get replayed against unrelated sites.
• Automation frameworks like Sentry MBA or OpenBullet drive the attempts through rotating proxies.
• Bot fingerprint evasion mimics real browser behavior to slip past basic bot detection.
• Targets password reuse specifically — the same pair often unlocks multiple unrelated services.
• Monetizes hijacked accounts directly — loyalty points, stored payment methods, or resale of verified-valid pairs.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

How to Detect It

• Watch for spikes of logins with a high-valid-username, moderate-success ratio — the signature of a combolist run.
• Flag login attempts arriving from distributed IPs in a short window.
• Correlate an unusual device/geo mix and success clustering on accounts known to reuse passwords elsewhere.

How to Defend Against It

• MFA is the decisive control — a correct password alone stops being enough.
• Screen new and changed passwords against known-breached password lists.
• Add bot management and device fingerprinting, rate limit login attempts, and alert users on sign-ins from new devices.

Validating Your Defenses

Replaying a sample of known-breached (non-production-sensitive) credential pairs against a test environment shows whether MFA and bot detection actually block the pattern. Track which pairs got through and where so the evidence lands in the pentest report instead of a scratch terminal you’ll lose.