Does AppCheck Perform Brute-Force Attacks?

By default, an AppCheck web application scan does not include brute forcing of arbitrary authentication barriers, but does include testing of weak and default credentials for CMS platform authentication barriers.

The web application scanner allows you to specify further credentials that will be used against any authentication barrier discovered in the target application:

1. Web Application Scanner Settings
   1. Advanced Settings
      1. Cyber Essentials Checks

This feature enables use of a list of credentials previously provided as part of the UK government's Cyber Essentials scheme.

1. Web Application Scanner Settings
   1. Advanced Settings
      1. Username Guessing List / Password Guessing List

This feature enables testing with a customer set of credentials.