How it stated. I saw a policy that reads:

or something like:

Then I took the challenge, to search for all possible bypass methodology I can find and try them, before long, I started to understand how Rate Limiting are setup. I began to see the mind set of the blue team as they setup these rate limiting.

What are they tracking? counter? - Username - Email address - Password Count - Parameter - Path/endpoints - Headers - Methods - IP address - User-Agent - Cookies - Client/Server side - etc , etc if I can answer this question, am almost likely to find the bypass.

Also the issues of what is the primary rate Limiting? Is there a secondary Rate Limiting ? All became clear.

For example if the rate limiting is tracking my device time, changing my IP address or Header will not do any good, what should be change is the device time.

Is the Rate Limiting enforced per-username? or per-session or IP address ?

You have to know how the rate limit is working first, if you know then its much easier to bypass it, don't hack blindly, take your time, figure out what is being used to trigger the rate limiting, how are they identifying and tracking request patterns???

Finally, don't ask me HOW? figure it out, that's on you to do, you called yourself a hacker, hack by practicing and figuring things out for yourself, I am still trying to figure out how to bypass h1 ..... 😜😜😜

Ok ok ok, little quiz: I tried harris0ft1 as username (after 429 with username harris0ft) and observed that I see the normal ``Invalid username or password`` message. IS THIS SYSTEM RATE LIMIT ENFORCED PER-USERNAME OR PER-SESSION?

Simple, that's how you figure it out step by step. Then hack accordingly.

Happy weekend!!! Tgif.

@OX0DAYS - endpoints where I have found rate limiting and attempt to bypass are: 1- Account Registration/Signup 2- Login - Account Lock - Backend 3- Forgot-Password - email Sent 4- Reset-Password - CURRENT Password 5- 2FA/MFA - code 6- OTP 7- Subscribe - email sent

8- Sending messages in forums, Pin code, coupon codes, comments, etc. 9- Sending Unlimited Invites 10- View QR Code, Acct Secret key, etc 11- Disabled 2FA, SMS, etc - CURRENT Password 12- RECIEVING OTP 13- RE-SEND/REGENERATE OTP code via SMS 14- to RE-FRESH OTP

I normally don't hurt for rate limiting bypass, I just hack and when am rate limited, I smile and bypassed it, submit bypass report and continue to hack.

@0xabfe 1- Case-Sensitive Attempt Counter 2- Change Email font 3- Blank Characters or space to email address 4- add Null Byte (%00) at the end of the email and resend 5- add CRLF (%09,%0a, %0d) at the end of the email and resend 6- add blank bytes like %00, %20, %0d%0a

7- add special characters to the email #, %0', /n, \n, %0C, 8- Change the email address 9- Try Encode Techniques 10- many many ways shall ask chatGPT

Few days ago, I already had the bypassed, just wanted to be sure it will be rewarded.

Some programs even change their h1 policy when I hit them with "too much" bypass. And this is the real fun I get from bypassing rate limiting, outside the $$$.

The best way to report Rate-limiting Bypass bug that will PAY-OUT is to use it in another attack as explained by @hunter0x7 here. https://x.com/hunter0x7/status...

@harris0ft Bro is a rate limit god 🤯

@revenixx Nope, still learning... just have a decent understanding of how it works.

@harris0ft I submit many Rate Limiting Bypass , but They were marked as Informational or Dunplicated. No bounty.😭

@fishcccc Then choose your program wisely. Read program policy b4 u start hacking.

@harris0ft Where you try the most post request or like forget password, login, sign up, tell your endpoints?

@OX0DAYS https://x.com/harris0ft/status... https://x.com/harris0ft/status...

@harris0ft Rate limiting bypass is a silent but dangerous threat—especially for services handling sensitive user data. 🔐 Continuous monitoring and smart throttling are key. #CyberSecurity #DataProtection

@seclypt Especially when chain with Side-Channel BOLA. It makes brute force interesting.

@harris0ft Share some tips bro

@Mustaquemx Ask a wise question, tip may be in the answer.

@harris0ft Rate limiting should be categorized as performance testing and not penetration testing

@rival_rvdt We are not discussing Rate Limiting here, it's Rate Limiting BYPASS we are discussing.

@harris0ft Yo! Thanks for these tips. Very helpful ☺️

@Edi4all Yoyo, go find some bypass!!!

@harris0ft Awesome

@peterChain7 Thanks