Hello,
Today I’m sharing How I bypass the rate-limit restriction during testing on a self-hosted program (redacted.com).
The application implemented a login rate limit allowing a maximum of 5 attempts per day per IP. While this control is intended to prevent brute-force and abuse, it relied only on source IP address for enforcement.
Because the platform operates in a Web3 environment where availability and latency are critical, ineffective abuse controls can directly impact trading activity and platform stability.
Press enter or click to view image in full size
So, I decided to bypass that I tried many ways include extra header in request but most of them didn’t work at last the IP rotate work. here is how it works.
Step to reproduce
- Visit the login page
- Intercept the request of credential
- Send it to intruder and run the script
- You will notice you have been blocked after 5 tries
- Now use IP rotate to change IP and continue the attack
- You will notice no block to the IP and you can brute force it
Impact
- Abuse of protected actions (automation…