I am working on a SharePoint 2013 (on premise) application where I have implemented Forms Based Authentication (FBA) wherein usernames and passwords are saved (in encrypted format) in SQL membership database. On the login page, there are only two fields - username and password.

I just want to understand that how an attacker over the internet can launch an automated attack against the application as CAPTCHA has not been implemented in ‘User Registration’ page. This can cause a denial of service to genuine users of `the application. This has been highlighted in the application vulnerability and penetration testing and I need to respond for this vulnerability.

Although my response would be - CAPTCHA is generally implemented for public facing sites over the Internet. This application is an Intranet based which is implemented on top of SharePoint 2013 which do not provides any CAPTCHA functionality OOTB.

Quick help would be highly appreciable!

1 Answer 1


Denial of Service (DDoS) attacks:

These attacks are aimed at overwhelming an Intranet with data requests, which makes it inoperable.

To protect against DDoS attacks, IT professionals should utilize such tools as firewalls, and load balancers to control the volume of traffic reaching your intranet.

You could refer to the following articles to configure Network Load Balancing for SharePoint 2013:

More information about protect SharePoint Internal Websites, please refer to "How to Protect Internal Websites from Security Threats".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.