What Is Credential Stuffing?
Imagine a burglar who does not need to pick a lock — because they already have a copy of your key. That is the essence of credential stuffing.
In January 2019, security researcher Troy Hunt published what became known as "Collection #1": a database of approximately 773 million unique email addresses and 21 million unique passwords scraped from thousands of individual data breaches. Collection #1 was not even considered unusual — it was simply the one that made the news that week. Aggregated breach repositories now contain billions of verified credential pairs and are freely traded on dark web forums and private Telegram channels.
Credential stuffing is the automated practice of taking those breach lists and submitting each pair to a target application's login endpoint. The attacker is not guessing. They are not running a dictionary attack. They are testing passwords that real users willingly created and, crucially, reused across multiple services.
The Tooling Is Mature and Accessible
Attackers use purpose-built automation tools — Sentry MBA, Snipr, STORM — that accept per-site configuration modules called "configs." A config tells the tool exactly how to structure the login request, where to find the success/failure indicator in the response, and how to rotate through proxy pools to avoid IP-based rate limiting. Setting up a credential stuffing campaign against a new target is, for an experienced adversary, a matter of hours.
Real-World Impact: Nintendo, 2020
In April 2020, Nintendo disclosed that approximately 160,000 Nintendo Network ID (NNID) accounts had been compromised. The attacker used credentials leaked from unrelated third-party services. Victims reported unauthorized purchases of Nintendo eShop currency, linked PayPal accounts accessed, and personal information exposed. Nintendo's own infrastructure was never breached — the attacker simply tested credentials that Nintendo's users had reused from other compromised sites.
Why It Is an A07:2021 Issue
OWASP classifies this under A07:2021 - Identification and Authentication Failures. The application failed to detect or prevent automated, high-volume login attempts using valid credentials from external breaches. The application had no mechanism to distinguish a legitimate user authenticating normally from a bot working through a list of 50,000 pairs.
What You Will Do in This Lab
In the simulation panel on the right, you will run a simplified credential stuffing attack against a mock login endpoint. You will load a wordlist of 15 credential pairs, start the attack, and observe the request counter, the success/failure tally, and the hit log as the simulation runs. One account in the list uses a password that matches a previous breach. Your task is to identify which account was compromised. After completing the simulation, you will explore the controls that would have stopped the attack before it succeeded.