No Rate Limit
Summary : No Rate Limit is a type of computer security vulnerability typically found in web applications. No Rate Limit enables attackers to perform actions on the web application where the attacker can do signup creation, password reset or 2FA of other users. No Rate Limit vulnerability may be used by attackers to bypass access controls such & bruteforce tokens and passwords without any limiting of any requests. There should be protection on the web application for sensitive actions. Attackers send a high number of requests to perform desirable actions to get access to the application or accounts.
NO RL effects vary in range from petty nuisance to significant security risk, depending on the sensitivity of the data handled by the vulnerable site and the nature of any security mitigation implemented by the site's owner network.
Severity : High
POST Request :
Complexity : Easy
From : Remote / External
Steps to Reproduce:
Impact :An Adversary can carry out No Rate-Limit attack and also can take over the victim Account.
Also, an adversary can manage to login through any other user's account.
Affected IP's : IP Address Port
https://www.example.com/ 443
Recommendations :
There should be a protection on the web application for limiting the users simultaneous requests.
Any user should be Rate limited if He/She sends or races high amount of requests in a significant amount of time.
References :
https://hackerone.com/reports/743545
https://hackerone.com/reports/385381
https://hackerone.com/reports/297359
Proof of Concept :
Call us any time:
+91 9106147779Email us 24/7 hours:
shifa@hacktify.inCopyright © 2023 Hacktify All Rights Reserved.
WhatsApp us