Methods to Bypass Rate Limit

Today, I am sharing commonly used rate limit bypass tricks during Penetration Testing and Bug hunting.

Rate limit …..Hmmm, Let's bypass it.

But what is the rate limit?

Developers often use rate limits to control the number of requests per user. Basically, the rate limit is used to control the rate of traffic sent or received on the network.

Before we jump into bypass, let's dig into places where we can find it.

· Login

· Reset Password

· 2FA/OTP

· Sign up

· Sending messages, Pin code, Forums, comments, and coupon codes, etc.

Methods to Bypass rate limit

1. Using different parameter, suppose rate limit is on signup, try to use

sign-up, Sign-up, SignUp

Default Request

Bypassing rate limit using different parameter

2. Use the following request-header or use the Bypass WAF tool for this.

X-Originating-IP: 127.0.0.1

X-Forwarded-For: 127.0.0.1

X-Remote-IP: 127.0.0.1

X-Remote-Addr: 127.0.0.1

or

Try with X-Forwarded-For: IP Header 2x times Instead of One time. (Tip from Kiraak Boy)

Sometimes, it is showing 20 Request per account, you can bypass it by using different IP after 20 attempts

bypassing with x-forwarder-for

3. Using null byte and CRLF (a tip from Zseano)

%00, %0d%0a, %09, %0C, %20, %0

4. Changing user-agents, cookies, and IP address

5. Through IP-Rotate Burp extension. When you enable the extension, each request will go through the AWS API Gateway endpoints in each region changing your source IP on each request to the target. For more info, you can visit the following site.
https://rhinosecuritylabs.com/aws/bypassing-ip-based-blocking-aws/

#HappyHacking #BugBountyTips