skills.rest
braydos-h
braydos-hCOMMUNITY
Explore all skills by this author →
GitHub

performing-api-rate-limiting-bypass

Tests API rate limiting implementations for bypass vulnerabilities via header, path, and method manipulation.

4|Updated Apr 28, 2026
Search Tags:#rate limiting#owasp#penetration testing#brute force#api security#x-forwarded-for#throttling bypass
One-click install
npx skills add https://github.com/braydos-h/BreachPilot --skill performing-api-rate-limiting-bypass-braydos-h
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-api-rate-limiting-bypass
Source: https://github.com/braydos-h/BreachPilot/tree/main/skills/performing-api-rate-limiting-bypass
Command: npx skills add https://github.com/braydos-h/BreachPilot --skill performing-api-rate-limiting-bypass-braydos-h

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, aiohttp, and includes scripts (resource) and references (resource) components.

What problem does it solve? Security testers need to verify whether API rate limiting controls actually prevent brute force attacks, credential stuffing, and resource exhaustion, but rate limits are often enforced inconsistently across IPs, methods, paths, and API versions. ## Core Features & Use Cases - Rate Limit Discovery: Probes endpoints to detect rate limit headers (X-RateLimit-Limit, Retry-After) and establishes baseline throttling thresholds. - Bypass Technique Testing: Tests X-Forwarded-For and other IP spoofing headers, URL path variations, HTTP method switching, content-type changes, parameter pollution, and concurrent race conditions. - Structured Findings Output: Produces severity-rated findings mapped to OWASP API4:2023 Unrestricted Resource Consumption with remediation guidance. - Use Case: Before a compliance audit, a security team tests a login endpoint and discovers that rotating X-Forwarded-For headers bypasses the 10-requests-per-minute limit, enabling unlimited credential stuffing attempts. ## Quick Start Run the rate limiting bypass test against my authorized staging API endpoint at https://staging.example.com/api/v1/auth/login with header, method, and path bypass checks enabled.

Frequently Asked Questions about performing-api-rate-limiting-bypass

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test API rate limiting for bypass vulnerabilities?▼

Send baseline requests until a 429 response appears, then retry with rotated X-Forwarded-For headers, path variations like trailing slashes, alternate HTTP methods, and different content types. Any request that succeeds after the limit triggers indicates a bypass.

What headers can bypass IP-based rate limiting?▼

Common bypass headers include X-Forwarded-For, X-Real-IP, X-Originating-IP, X-Client-IP, True-Client-IP, CF-Connecting-IP, and the RFC 7239 Forwarded header. These work when the server trusts client-supplied headers without validation from a trusted proxy.

What tools are used for rate limit bypass testing?▼

The workflow uses Python with requests and aiohttp for scripted and concurrent testing, Burp Suite with Turbo Intruder for high-speed request sending, and cURL for manual header manipulation. ffuf and wfuzz also support header injection fuzzing.

Is rate limit bypass testing legal to perform?▼

Only with explicit written authorization specifying target endpoints and acceptable request volumes. Rate limit testing sends high request volumes that can impact service availability, so unauthorized testing may violate computer misuse laws and cause denial of service.

Why does rate limiting fail on some API endpoints?▼

Rate limits often fail due to per-IP-only enforcement bypassed by header spoofing, inconsistent rules across HTTP methods or API versions, unnormalized URL paths treated as distinct endpoints, and race conditions in non-atomic counters.

Related Skills

Explore More Software Engineering Skills→
Liberty91LTDLiberty91LTD
15

shodan-api

Query the Shodan API for host information and banners.

Official
Intermediate
wgpsecwgpsec
1.6k

report-generate

Generate structured penetration testing reports with CVSS risk ratings and remediation guidance.

Official
Intermediate
marquesfelipmarquesfelip

brute-force-protection

Enforce rate limits, lockouts, and MFA on authentication endpoints.

Community
Advanced
DeiblerDeibler
8

scaling-load-assumptions

Verify and design systems for load scaling across data volume, request rate, and user count.

Community
Intermediate