Systems and methods for rapid password compromise evaluation

1. A method for rapid password evaluation, the method comprising:

configuring a web application firewall (WAF) to monitor login credentials for one or more web applications;

intercepting, using the WAF, a password input during a login attempt to a web application by an entity;

calculating a hash value of the password input;

transmitting the hash value to a dedicated server configured to:

determine whether the hash value is in a database of hashes corresponding to weak passwords; and

in response to determining that the hash value is in the database of hashes, transmit a message to the WAF indicating that the password input corresponds to a weak password;

generating for display, using the WAF, a web page prompting for a password reset for the web application, and

wherein the dedicated server is further configured to:

receive and store, in a record database, an IP address of the entity and information about the login attempt;

determine, based on entries in the record database, whether the IP address is associated with at least a threshold number of successful login attempts to the web application; and

in response to determining that the IP address is associated with at least the threshold number, store the IP address in a whitelist.

2. The method of claim 1 , wherein the dedicated server is further configured to:

retrieve, from the record database, information about a first plurality of login attempts made by the entity in the web application for different user profiles; and

in response to determining that at least a first threshold number of login attempts have been performed by the entity, store the IP address in a blacklist.

3. The method of claim 2 , further comprising:

detecting a subsequent login attempt at the web application or a different web application; and

in response to determining that the subsequent login attempt is through the IP address in the blacklist, preventing authorization to login successfully.

4. The method of claim 2 , wherein the first plurality of login attempts further comprises a subset of login attempts made by the entity in at least one other web application.

5. The method of claim 2 , wherein the first plurality of login attempts further comprises a subset of login attempts made by the entity using more than one password from the database of hashes for a single user profile.

6. The method of claim 1 , wherein the dedicated server is further configured to:

prior to determining whether the hash value is in the database of hashes, determining whether the IP address is in the whitelist; and

in response to determining that the IP address is in the whitelist, transmitting a message to the WAF to enable login without evaluating the password input.

7. The method of claim 6 , wherein the dedicated server is further configured to:

determine whether the database of hashes has been updated with new password hash values since a last login attempt from the IP address in the whitelist; and

in response to determining that the database of hashes has been updated, compare the hash value to the new password hash values.

8. The method of claim 7 , wherein the dedicated server is further configured to:

determine, based on a comparison, whether the hash value matches the new password hash values; and

in response to determining that the hash value matches the new password hash values, transmit a message to the WAF indicating that the password input corresponds to a weak password.

9. The method of claim 8 , wherein the dedicated server is further configured to:

in response to determining that the hash value does not match the new password hash values, not perform a password evaluation until the database of hashes is updated.

10. The method of claim 1 , wherein the web page redirects to a password reset page of the web application.

11. The method of claim 1 , wherein the intercepting occurs prior to logging into the web application.

12. The method of claim 1 , wherein calculating the hash value of the password input further comprises obfuscating the password input using a salt value that is concatenated with the password input prior to hashing.

13. The method of claim 12 , wherein the salt value has a lifetime after which a new salt value is generated for concatenation with a new password input.

14. A system for rapid password evaluation, the system comprising:

a hardware processor configured to:

configure a web application firewall (WAF) to monitor login credentials for one or more web applications;

intercept, using the WAF, a password input during a login attempt to a web application by an entity;

calculate a hash value of the password input;

transmit the hash value to a dedicated server configured to:

determine whether the hash value is in a database of hashes corresponding to weak passwords; and

in response to determining that the hash value is in the database of hashes, transmit a message to the WAF indicating that the password input corresponds to a weak password;

generate for display, using the WAF, a web page prompting for a password reset for the web application, and

wherein the dedicated server is further configured to:

receive and store, in a record database, an IP address of the entity and information about the login attempt;

determine, based on entries in the record database, whether the IP address is associated with at least a threshold number of successful login attempts to the web application; and

in response to determining that the IP address is associated with at least the threshold number, store the IP address in a whitelist.

15. The system of claim 14 , wherein the dedicated server is further configured to:

retrieve, from the record database, information about a first plurality of login attempts made by the entity in the web application for different user profiles; and

in response to determining that at least a first threshold number of login attempts have been performed by the entity, store the IP address in a blacklist.

16. The system of claim 14 , wherein the dedicated server is further configured to:

prior to determining whether the hash value is in the database of hashes, determining whether the IP address is in the whitelist; and

in response to determining that the IP address is in the whitelist, transmitting a message to the WAF to enable login without evaluating the password input.

17. The system of claim 16 , wherein the dedicated server is further configured to:

determine whether the database of hashes has been updated with new password hash values since a last login attempt from the IP address in the whitelist; and

in response to determining that the database of hashes has been updated, compare the hash value to the new password hash values.

18. A non-transitory computer readable medium storing thereon computer executable instructions for rapid password evaluation, including instructions for:

configuring a web application firewall (WAF) to monitor login credentials for one or more web applications;

intercepting, using the WAF, a password input during a login attempt to a web application by an entity;

calculating a hash value of the password input;

transmitting the hash value to a dedicated server configured to:

determine whether the hash value is in a database of hashes corresponding to weak passwords; and

in response to determining that the hash value is in the database of hashes, transmit a message to the WAF indicating that the password input corresponds to a weak password;

generating for display, using the WAF, a web page prompting for a password reset for the web application, and

wherein the dedicated server is further configured to:

receive and store, in a record database, an IP address of the entity and information about the login attempt;

determine, based on entries in the record database, whether the IP address is associated with at least a threshold number of successful login attempts to the web application; and

in response to determining that the IP address is associated with at least the threshold number, store the IP address in a whitelist.