FIXED #1333 Rate limit calls.
Clean-up duplicate functionality. EOL whitespace removed Changes to be committed: modified: extensions/admin_ui/controllers/authentication/authentication.rb
This commit is contained in:
@@ -52,11 +52,9 @@ class Authentication < BeEF::Extension::AdminUI::HttpController
|
||||
end
|
||||
|
||||
# check if under brute force attack
|
||||
time = Time.new
|
||||
if not timeout?(time)
|
||||
@session.set_auth_timestamp(time)
|
||||
return
|
||||
end
|
||||
return if not BeEF::Core::Rest.timeout?('beef.extension.admin_ui.login_fail_delay',
|
||||
@session.get_auth_timestamp(),
|
||||
lambda { |time| @session.set_auth_timestamp(time)})
|
||||
|
||||
# check username and password
|
||||
if not (username.eql? config.get('beef.credentials.user') and password.eql? config.get('beef.credentials.passwd') )
|
||||
@@ -115,17 +113,6 @@ class Authentication < BeEF::Extension::AdminUI::HttpController
|
||||
return target_network.include?(ip)
|
||||
end
|
||||
|
||||
#
|
||||
# Brute Force Mitigation
|
||||
# Only one login request per login_fail_delay seconds
|
||||
#
|
||||
def timeout?(time)
|
||||
config = BeEF::Core::Configuration.instance
|
||||
login_fail_delay = config.get('beef.extension.admin_ui.login_fail_delay') # get fail delay
|
||||
|
||||
# test if the last login attempt was less then login_fail_delay seconds
|
||||
time - @session.get_auth_timestamp > login_fail_delay.to_i
|
||||
end
|
||||
|
||||
|
||||
end
|
||||
|
||||
Reference in New Issue
Block a user