Weak Lock Out Mechanism
Check List
Methodology
Black Box
Account Lockout Bypass
Perform 10 consecutive login attempts with incorrect credentials.
Observe Error Message Change Note the response shifting to "Something went wrong" after the 10th failed attempt
Login with valid credentials immediately after the failed attempts and confirm a successful login
Verify that login is successful despite the triggered lockout Repeat to Validate Flaw Repeat failed login attempts and login with valid credentials to confirm the lockout bypass
Account Lockout Bypass Via Password Reset
Perform 5 consecutive login attempts with incorrect passwords using the target endpoint
Observe the account lockout after the 5th failed login attempt
Submit a POST request to the forgot password endpoint with the email of the locked account
Attempt to log in again with a new password to confirm that the account is unlocked
Continue sending login attempts and forgot password requests after every 5th failed attempt to sustain the attack
Rate Limit Bypass Via Endpoint Case Manipulation
Access https://app.target.com/signin and enter a valid email with an incorrect password for testing
Use Burp Suite to intercept the login request sent to POST /auth/identity/callbac[k]
Change the endpoint to POST /auth/identity/callbac[K] by altering the case of the last letter
Send the modified request to Burp Intruder and initiate a brute force attack with a password list
Observe that there is no rate limit after 1000 attempts; identify the single 200 response indicating a correct email and password
Password Reset Rate-Limit Bypass Via Trailing-Space Input Variation
Intercept the forgot password request
Send the request to the Repeater and forward it. You will receive a response indicating that the link to reset the password has been sent
Forward this request 4 more times. At this point, you should have received 5 password reset links in your email. After sending one more request, you will be blocked for 3 minutes
Modify the request to include a space after the email address
email=’email@gmail.com ‘ [see the space before the last quote in the email].
Send the above request 5 times, and you will receive 5 additional links in your email. After that, you will be blocked again
Repeat step 3 by adding another space after the email. By consistently adding a single space after every 5 attempts, you can successfully bypass the rate limit
Rate Limit Bypass via Endpoint Case Variation & Parameter Tampering
Send the request to Intruder and set the attack type to Cluster Bomb
Add two positions as follows: the first at the endpoint and the second for the “q” variable
The rate limit can be bypassed by changing the endpoint. For example, the original endpoint is ‘reset-password,’ and it can be altered to various combinations such as ‘Reset-Password’ and ‘RESET-PASSWORD’
To generate different combinations of endpoints, you can use Tinker (https://github.com/heydc7/Tinker) for parameter tampering
Payload 1
Payload 2
Start the attack. The rate limit will be bypassed & you can see 100s of emails in your mailbox
To make the attack appear more legitimate to the WAF, you can additionally set the Throttle (Intruder -> Options) to 1000 milliseconds (1 second)
Account Lockout Bypass Via Email Case Variation
Use an incorrect password and attempt to log in at https://client.target.com 16 times using an email like g4l2562z6v@tidissajiiu.com (Tip: Send the request to Burp Suite’s Repeater tool for easy replaying of attempts)
After 16 failed login attempts, the account will be locked. Even the correct password won’t work anymore
Response from Burp Repeater
{ "message": "Request limit exceeded. Please try again later.", "type": "too-many-requests" }
Change the case of a character in the email. For example, switch from g4l2562z6v@tidissajiiu.com to g4l2562z6v@tidiSsajiiu.com (s -> S)
Resume login attempts with any password, you’ll find that the rate limit doesn’t apply, even after 16 attempts
To verify, perform Step 3 and then log in with the correct password via the browser
Reuse Previous Captcha
Identify a previously seen captcha Choose a captcha code that you have already seen or solved before Explanation: This method assumes that the same captcha code might be accepted multiple times
Prepare the form submission Construct the request to submit the captcha
Example request:
Submit the same captcha repeatedly Submit the identical captcha code (for example, "ABC123") multiple times. Explanation: By sending the same code repeatedly, you hope that at least one attempt will be accepted by the server
Submit Empty Captcha
Trying to bypass the captcha by leaving the captcha field empty when submitting a form
Alter Data Format
Changing the format in which data is sent to the server, such as converting it to JSON or plain text, in the hope that the captcha won't be validated
A sample POST request with JSON data instead of the expected XML data
Change Request Method
Modify the way you send requests to the server by switching between different HTTP request methods like GET, POST, or PUT
A sample GET request instead of the expected POST request
Manipulate Headers
Using custom headers like X-Forwarded-For, X-Remote-IP, X-Original-IP, X-Remote-Addr, etc., to make it appear as though the requests are coming from different IP addresses, thereby avoiding captcha validation
A sample GET request with a custom "X-Forwarded-For" header
Inspect Parameters
Always thoroughly examine the entire request (body, headers, or uri part) and understand the purpose of each parameter. By changing certain parameter values, you might find a way to bypass the captcha
In this case, the "user_id" parameter might be related to captcha validation. By experimenting with different values for "user_id," you may discover a way to bypass the captcha
Human-Based Captcha Solving Services
Instead of automated methods, you can use human-based captcha-solving services where real individuals solve captchas for you in exchange for a fee
White Box
Cheat Sheet
Lockout Mechanism
Unique Lockout Mechanisms
Unlock Mechanism
Last updated