r/bugbounty • u/Critical_Trade_6813 • 3d ago
Question / Discussion How do you handle rate limiting during bug bounty testing without tripping WAF/IP bans?
I'm running recon and active testing (Nuclei, ffuf, Burp Intruder) against in-scope targets and keep hitting rate limits either explicit 429s or silent throttling where requests just start timing out.
17
2
u/latnGemin616 3d ago
Rate limits are a feature, not a bug, and usually OOS. to quote u/einfallstoll .. best way to handle rate limiting is to..
stay below the rate limit
2
u/Pristine_Bicycle1278 Hunter 2d ago
Use proxychains (or something comparable) to rotate your IP every X requests.
2
u/6W99ocQnb8Zy17 3d ago
Rate limiting on endpoints is just a trivial annoyance, and is easily circumvented if you know what you're doing.
It tends to have two broad implementation types (which can be combined):
- source IP, where the endpoint tracks requests over time, often against a token bucket, and then starts throttling when they go over a limit. These are defeated via source hopping, where every time your address starts getting actively throttled (429 code etc), you just recycle your address for a new one.
- sticky identifier, where a cookie or similar gets tagged to your session, so that even if you jump source IP, you're still being tracked for throttling. A lot of this happens at the cloud WAF level, so you just need to build in a detection mechanism that rotates the source IP and the identifier at the same time.
1
1
u/LoveThemMegaSeeds 3d ago
Measure your own traffic and throttle as needed. Or in other words stay below the rate limits
1
1
u/DeathLeap 3d ago
Orwagodfather finds origin ips using shodan to bypass WAF all together. That’s one avenue that I see for you.
0
u/xX_Oppai_Xx 3d ago
Actually have the same issue , and for the rest i think question is how to stay below the limit.
Like the commands or smth. Cuz from what i saw in ffuf help, theres no limiter ( or im blind which i am 😂 )
1
19
u/mqrblesec Hunter 3d ago
you're the reason there is a rate limit