F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

Dan_Bowman's avatar
Dan_Bowman
Icon for Cirrus rankCirrus
Oct 12, 2017

ASM Brute Force when app success/fail isn't the first response?

Hi guys,   I've been looking at configuring ASM Brute Force protection for a couple of web apps. The challenge I'm hitting is that the app doesn't instantly respond with a success/fail criterion ...
ASM Advanced WAF
brute force
security
Dan_Bowman's avatar
Dan_Bowman
Icon for Cirrus rankCirrus
Nov 08, 2017

Just to revisit this - I've been looking again at the app that has username on screen 1 and then password on screen 2. Is it possible to persist the username entered on screen 1 and then pass via an iRule to Brute Force so that it can be matched against the password as a pair?

 

As it stands I've configured screen 1 and screen 2 as separate login pages, but not having username available on screen 2 is proving troublesome for accurate BF detection.