Web Wiz Forums - username and password incorrect hack?

Print Page | Close Window

username and password incorrect hack?

Printed From: Web Wiz Forums
Category: Web Wiz Web App Support Forums
Forum Name: Web Wiz Forums
Forum Description: Support forum for Web Wiz Forums application.
URL: https://forums.webwiz.net/forum_posts.asp?TID=16812
Printed Date: 16 April 2026 at 6:30am
Software Version: Web Wiz Forums 12.08 - https://www.webwizforums.com

Topic: username and password incorrect hack?

Posted By: manster
Subject: username and password incorrect hack?
Date Posted: 04 October 2005 at 9:40pm

I'm having a rather strange login problem. Randomly some user are complaining that they cannot login. They were able to login before perfectly, but all of a sudden some can't. So I have to reset the password for them to get back in. They are getting the message, "sorry, the username or password entered is incorrect."

I also tried to do it from another computer and I can't login for them. I have deleted cache and cookies and that did not solve the problem. I have to login as an administrator and change their password to be able to login again. I'm running sql server 2000 on a windows server 2003. I have to do this every now and then for it's very random. And yes I've added the domain to allow cookies.

Have I been hacked? I did not have the 7.2 patch. Now I do, and I'm testing.

Thanks

Replies:

Posted By: WebWiz-Bruce
Date Posted: 05 October 2005 at 5:28am

I have had serveral people report recently that people are using the forgotten password feature to change other users passwords.

How the forgotten password fetaure works is to gernerate a new password for the user and email it to them, as passwords are 160bit one way encrypted they can not be recovered so new passowrds have to be generated.

It maybe worth asking your members with this problem to check their email accounts to see if they have a changed password email.

To prevent this problem in future versions I am planning on creating a new system that asks the user when registering to put in a secrete question and aswer, then only send the new password if this question is answered correctly.

-------------
https://www.webwiz.net/web-wiz-forums/forum-hosting.htm" rel="nofollow - Web Wiz Forums Hosting
https://www.webwiz.net/web-hosting/windows-web-hosting.htm" rel="nofollow - ASP.NET Web Hosting

Posted By: manster
Date Posted: 05 October 2005 at 12:10pm

Thanks Borg, but I had already read that post. This does not seem to be the issue. The email addresses are fine, because it happened to oney of my usernames as well. I have to reset them to log back in or click forgotten password. Even though, in some cases the forgotten password that is in the email does not work for some users either, this might be another issue as well.

Thanks