Rate limit vulnerabilities
Rate limit vulnerabilities · from Anas-Magane/Pentesting (TOP_10_OWASP / Rate Limit vulnerability).
1- no rate limit on login page 2- no rate limit on internal password 3- no rate limit on sending reset password link 4- no rate limit on OTP or 2FA => account takeover 5- no rate limit on contact us page 6- no rate limit on comments 7- no rate limit on reports of comments 8- no rate limit on port 22
Bypass rate limit by adding headers
X-Forwarded-For: 127.0.0.1 X-Forwarded-Host: 127.0.0.1 X-Origination-IP: 127.0.0.1 or 0.0.0.0 X-Fowarded-For: 127.0.0.1 X-Remote-IP: 127.0.0.1 X-Remote-Addr: 127.0.0.1