I am working on a SharePoint 2013 (on premise) application where I have implemented Forms Based Authentication (FBA) wherein usernames and passwords are saved (in encrypted format) in SQL membership database. On the login page, there are only two fields - username and password.
I just want to understand that how an attacker over the internet can launch an automated attack against the application as CAPTCHA has not been implemented in ‘User Registration’ page. This can cause a denial of service to genuine users of `the application. This has been highlighted in the application vulnerability and penetration testing and I need to respond for this vulnerability.
Although my response would be - CAPTCHA is generally implemented for public facing sites over the Internet. This application is an Intranet based which is implemented on top of SharePoint 2013 which do not provides any CAPTCHA functionality OOTB.
Quick help would be highly appreciable!