{"action":"created","issue":{"url":"https://api.github.com/repos/GetLuna/Luna/issues/1363","repository_url":"https://api.github.com/repos/GetLuna/Luna","labels_url":"https://api.github.com/repos/GetLuna/Luna/issues/1363/labels{/name}","comments_url":"https://api.github.com/repos/GetLuna/Luna/issues/1363/comments","events_url":"https://api.github.com/repos/GetLuna/Luna/issues/1363/events","html_url":"https://github.com/GetLuna/Luna/issues/1363","id":107968036,"number":1363,"title":"Brute Force attack on Luna","user":{"login":"mohsennirouzad","id":14808893,"avatar_url":"https://avatars.githubusercontent.com/u/14808893?v=3","gravatar_id":"","url":"https://api.github.com/users/mohsennirouzad","html_url":"https://github.com/mohsennirouzad","followers_url":"https://api.github.com/users/mohsennirouzad/followers","following_url":"https://api.github.com/users/mohsennirouzad/following{/other_user}","gists_url":"https://api.github.com/users/mohsennirouzad/gists{/gist_id}","starred_url":"https://api.github.com/users/mohsennirouzad/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mohsennirouzad/subscriptions","organizations_url":"https://api.github.com/users/mohsennirouzad/orgs","repos_url":"https://api.github.com/users/mohsennirouzad/repos","events_url":"https://api.github.com/users/mohsennirouzad/events{/privacy}","received_events_url":"https://api.github.com/users/mohsennirouzad/received_events","type":"User","site_admin":false},"labels":[{"id":35998418,"url":"https://api.github.com/repos/GetLuna/Luna/labels/security","name":"security","color":"ffba00","default":false}],"state":"open","locked":false,"assignee":{"login":"Studio384","id":1693592,"avatar_url":"https://avatars.githubusercontent.com/u/1693592?v=3","gravatar_id":"","url":"https://api.github.com/users/Studio384","html_url":"https://github.com/Studio384","followers_url":"https://api.github.com/users/Studio384/followers","following_url":"https://api.github.com/users/Studio384/following{/other_user}","gists_url":"https://api.github.com/users/Studio384/gists{/gist_id}","starred_url":"https://api.github.com/users/Studio384/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Studio384/subscriptions","organizations_url":"https://api.github.com/users/Studio384/orgs","repos_url":"https://api.github.com/users/Studio384/repos","events_url":"https://api.github.com/users/Studio384/events{/privacy}","received_events_url":"https://api.github.com/users/Studio384/received_events","type":"User","site_admin":false},"assignees":[{"login":"Studio384","id":1693592,"avatar_url":"https://avatars.githubusercontent.com/u/1693592?v=3","gravatar_id":"","url":"https://api.github.com/users/Studio384","html_url":"https://github.com/Studio384","followers_url":"https://api.github.com/users/Studio384/followers","following_url":"https://api.github.com/users/Studio384/following{/other_user}","gists_url":"https://api.github.com/users/Studio384/gists{/gist_id}","starred_url":"https://api.github.com/users/Studio384/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Studio384/subscriptions","organizations_url":"https://api.github.com/users/Studio384/orgs","repos_url":"https://api.github.com/users/Studio384/repos","events_url":"https://api.github.com/users/Studio384/events{/privacy}","received_events_url":"https://api.github.com/users/Studio384/received_events","type":"User","site_admin":false}],"milestone":null,"comments":1,"created_at":"2015-09-23T17:29:52Z","updated_at":"2016-11-19T21:40:40Z","closed_at":null,"body":"Hello,\nI installed Luna \"Cornflower Blue Preview 1\" on my Localhost ( Wamp server ),\nMy administrator account info was:\n\"Username: Administrator, Password: 75144920\"\nAnd I wanted to test Luna in defense about Brute Force Attacks, But when I started cracking administrator's password on login page ( at index.php ) I didn't saw any defenses about Brute Force and Luna supported password cracking attack,\nI wondered and I looked for any setting for this section but I found nothing...\nThis is very very important because most users doesn't use a strong password like me and It will be DANGEROUS.\nAttack Information:\nAttacker: HP Pavilion G6 At Localhost (Offline Mode)\nHost Software: Luna Cornflower Blue Preview 1\nBrowser Agent: Mozilla FireFox V.41\nAdd-On for BruteForce: FireForce\nResult: If I was continue, I'm sure password will found....  smile\n\nBest solve:\nSent a number ID with login request ( That will add in every try to login ) and save it in a session or Database, If this number be was equal to 5, Luna make a captcha or doesn't agree to login in 30seconds.\nLike this form:\n<?php\n# By: Mohsen Nirouzad\n\n$pre_tries=$_REQUEST[\"login_tries\"];\n$tries=$pre_tries+1;\n?>\n\n<fieldset><legend>Login</legend>\n  <form role=\"form\" action=\"<?php $_SERVER['PHP_SELF'] ?>\" method=\"post\" name=\"frm_login\" id=\"frm_login\" autocomplete=\"off\" title=\"Login Form\" accept-charset=\"UTF-8\">\n  <label for=\"txt_username\">Password:</label>\n      <input name=\"txt_username\" type=\"text\" autofocus=\"autofocus\" required=\"required\" id=\"txt_username\" form=\"frm_login\" title=\"Username\" size=\"40\" maxlength=\"40\">\n      <label for=\"txt_password\">Password:</label>\n      <input name=\"txt_password\" type=\"password\" required=\"required\" id=\"txt_password\" form=\"frm_login\" title=\"Password\" size=\"40\" maxlength=\"40\">\n      <input name=\"login_tries\" type=\"hidden\" id=\"login_tries\" form=\"frm_login\" value=\"<?php $tries ?>\">\n  </form>\n</fieldset>\n\nMyBB uses this way for defense Brute Force Attacks too...\nI think I sent too much requests to Luna Support, Don't be angry Yannick!  big_smile\n"},"comment":{"url":"https://api.github.com/repos/GetLuna/Luna/issues/comments/261741463","html_url":"https://github.com/GetLuna/Luna/issues/1363#issuecomment-261741463","issue_url":"https://api.github.com/repos/GetLuna/Luna/issues/1363","id":261741463,"user":{"login":"Namnodorel","id":10784607,"avatar_url":"https://avatars.githubusercontent.com/u/10784607?v=3","gravatar_id":"","url":"https://api.github.com/users/Namnodorel","html_url":"https://github.com/Namnodorel","followers_url":"https://api.github.com/users/Namnodorel/followers","following_url":"https://api.github.com/users/Namnodorel/following{/other_user}","gists_url":"https://api.github.com/users/Namnodorel/gists{/gist_id}","starred_url":"https://api.github.com/users/Namnodorel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Namnodorel/subscriptions","organizations_url":"https://api.github.com/users/Namnodorel/orgs","repos_url":"https://api.github.com/users/Namnodorel/repos","events_url":"https://api.github.com/users/Namnodorel/events{/privacy}","received_events_url":"https://api.github.com/users/Namnodorel/received_events","type":"User","site_admin":false},"created_at":"2016-11-19T21:40:40Z","updated_at":"2016-11-19T21:40:40Z","body":"I'd suggest using reCAPTCHA for this one (maybe after 3 failed login attempts on an account within an hour). It it is easy to implement it, it works good and is a good choice in terms of UX because so many other websites use it that it has a known, consistent look for the user."}}
{"actor":{"display_login":"Namnodorel"}}