Rate Limit Flaws
RATE LIMIT FLAWS
This flaw leveraged by malicious actors to perform DDoS, brute force, and bot attacks on APIs. Although it's more than that.
NOTE: Some organisation keep rate-limit bug as OOS, So check their policy before testing.
Rate-limit Checks
1 - Rate limit on Forget password 2 - Rate limit on Sign-up Page 3 - Rate limit on Login Page 4 - Rate limit on Invite user normal 5 - Rate limit on Invite user using MACROS 6 - Rate limit on 2FA 7 - Rate-limit on Comment and sent messages 8 - Use your own brain somewhere
Bypass-Techniques
1 - Append NULL characters at the end of the request :
%00, %0d%0a, %0d, %0a, %09, %0C, %20, ( )space
2 - Append NULL characters at the end of the Path :
%00, %0d%0a, %0d, %0a, %09, %0C, %20, ( )space POST /profile/post/like%00 HTTP/2
3) Using Custom HTTP headers
4 - Changing the value of User-Agent:
5 - Adding Custom parameter in GET request
GET /accout/passwordreset/?test=test
6 - Change request body, (JSON -> XML) or vice versa
Use Burp Extension --> Content Type Converter
7 - Changing API version ,
/api/v2/user/reset_pw --> /api/v1/user/reset_pw or /api/v3/user/reset_pw
8 - Bypass through Exploiting Logic flaw on Login page,
Take Attacker and Victim account
Identify how many enough login attempts in application
For-eg. if application gives only 3 attempts, then
By using burp macros, send the attackers login request 1 time and victim login request 2 time, or alternatively
If NOT blocked, Repeat the process until we get victim's password
9 - Try to find Origin IP of the Application
Shodan
Censys
Visit the application with it's IP address
Do your own research
Last updated