The purpose of this demo is to show how a BIG-IP Advanced WAF security policy can protect a web application against brute force attacks where the malicious user employs individuals to enter CAPTCHA challenges. In this demo we will:
1. Show the existing brute force protection that is configured to identify attacks from a single source IP address and then present the user with a CAPTCHA challenge.
2. Show that you can enter an unlimited number of CAPTCHA challenges and still gain access to the web application.
3. Configure brute force protection to limit the number of successful CAPTCHA challenges.
4. Show the results when attempting the attack again.