Credential stuffing attacks use lists of breached username-password pairs to attempt login across other services — exploiting the reality that many users reuse passwords. Testing evaluates: rate limiting effectiveness (can an attacker attempt thousands of logins?), account lockout mechanisms, CAPTCHA implementation and bypass potential, credential breach detection (does your application check passwords against known breach databases?), multi-factor authentication enforcement, bot detection effectiveness, and alerting on suspicious login patterns.
Technical
Credential Stuffing Prevention: Testing Your Defences Against Automated Account Takeover pour les entreprises francophones
Credential stuffing uses breached passwords to access accounts at scale. Testing whether your application can detect and prevent it. Guidance for FR market.