Rate Limit Flaws

RATE LIMIT FLAWS

This flaw leveraged by malicious actors to perform DDoS, brute force, and bot attacks on APIs. Although it's more than that.

NOTE: Some organisation keep rate-limit bug as OOS, So check their policy before testing.

Rate-limit Checks

1 - Rate limit on Forget password 2 - Rate limit on Sign-up Page 3 - Rate limit on Login Page 4 - Rate limit on Invite user normal 5 - Rate limit on Invite user using MACROS 6 - Rate limit on 2FA 7 - Rate-limit on Comment and sent messages 8 - Use your own brain somewhere

Bypass-Techniques

1 - Append NULL characters at the end of the request :

%00, %0d%0a, %0d, %0a, %09, %0C, %20, ( )space

POST /signup/new/1337 HTTP/1.1
HOST: api.target.com
...
email=hacker%40gmail.com&password=12345678%00

2 - Append NULL characters at the end of the Path :

%00, %0d%0a, %0d, %0a, %09, %0C, %20, ( )space POST /profile/post/like%00 HTTP/2

3) Using Custom HTTP headers

X-Originating-IP: 127.0.0.1
X-Forwarded-For: 127.0.0.1
X-Remote-IP: 127.0.0.1
X-Remote-Addr: 127.0.0.1
X-Client-IP: 127.0.0.1
X-Host: 127.0.0.1
X-Forwared-Host: 127.0.0.1

---

X-Originating-IP: 127.0.0.2
X-Forwarded-For: 127.0.0.2
X-Remote-IP: 127.0.0.2
X-Remote-Addr: 127.0.0.2
X-Client-IP: 127.0.0.2
X-Host: 127.0.0.2
X-Forwared-Host: 127.0.0.2

---

X-Originating-IP: 127.0.1
X-Forwarded-For: 127.0.1
X-Remote-IP: 127.0.1
X-Remote-Addr: 127.0.1
X-Client-IP: 127.0.1
X-Host: 127.0.1
X-Forwared-Host: 127.0.1

4 - Changing the value of User-Agent:

UserAgent: 'CHANGED_USERAGENT'

5 - Adding Custom parameter in GET request

GET /accout/passwordreset/?test=test

6 - Change request body, (JSON -> XML) or vice versa

Use Burp Extension --> Content Type Converter

7 - Changing API version ,

/api/v2/user/reset_pw --> /api/v1/user/reset_pw or /api/v3/user/reset_pw

8 - Bypass through Exploiting Logic flaw on Login page,

• Take Attacker and Victim account

• Identify how many enough login attempts in application

• For-eg. if application gives only 3 attempts, then

• By using burp macros, send the attackers login request 1 time and victim login request 2 time, or alternatively

• If NOT blocked, Repeat the process until we get victim's password

9 - Try to find Origin IP of the Application

• Shodan

• Censys

• Visit the application with it's IP address

• Do your own research