Member-only story

$200 Easy Bounty: Improper Rate Limiting Exploit

It4chis3c
InfoSec Write-ups
Published in
3 min readFeb 6, 2025

Rate Limiting gives you Easy Bounty

Friend Link | Free Link

Hi geeks, it4chis3c (Twitter) came-up with the write-up on Improper Rate Limiting Vulnerability found on one of the target’s internal login page.

Credit: Copilot

During my OSINT reconnaissance on *.target.com, I discovered an IP (198.x.x.x) hosting the target Login Page. Interestingly, the SSL certificate belonged to xy.target.com, indicating a possible misconfiguration.

Discovery & Exploitation

I decided to test the authentication page (https://198.x.x.x/target-protect/login.esp) for improper rate limiting using various brute-force techniques. After multiple tests, I found that the implementation of rate limiting was weak, allowing an attacker to brute-force login credentials effectively.

Steps to Reproduce:

  1. Navigate to the authentication page: https://198.x.x.x/target-protect/login.esp

2. Intercept the login request using Burp Suite & send it to Intruder.

Create an account to read the full story.

The author made this story available to Medium members only.
If you’re new to Medium, create a new account to read this story on us.

Or, continue in mobile web

Already have an account? Sign in

Published in InfoSec Write-ups

A collection of write-ups from the best hackers in the world on topics ranging from bug bounties and CTFs to vulnhub machines, hardware challenges and real life encounters. Subscribe to our weekly newsletter for the coolest infosec updates: https://weekly.infosecwriteups.com/

Written by It4chis3c

Security Researcher | Bug Bounties | Tips & Tricks

Responses (2)

Write a response