🚦 Rate Limiting Bypass Attack Flow
Circumventing API Rate Controls - OWASP API Security #4
flowchart TD
A[👤 Attacker] -->|1. Test rate limits| B[🔍 Discovery Phase]
B -->|2. Identify weak controls| C[🌐 API Endpoint]
C -->|3. Rotate IP addresses| D[🔄 Proxy/VPN Network]
C -->|4. Header manipulation| E[📋 X-Forwarded-For: spoofed]
C -->|5. Distributed requests| F[🤖 Botnet/Cloud IPs]
D -->|6. Bypass IP-based limits| G[❌ Weak Rate Limiting]
E -->|7. Spoof origin| G
F -->|8. Parallel attacks| G
G -->|9. Unlimited requests| H[💥 Resource Exhaustion]
G -->|10. Credential stuffing| I[🔓 Brute Force Success]
G -->|11. Data scraping| J[📊 Mass Data Theft]
H -->|12. Service degradation| A
I -->|13. Account takeover| A
J -->|14. Competitor advantage| A
style A fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style B fill:#74c0fc,stroke:#f59e0b,stroke-width:2px,color:#000
style C fill:#ffd43b,stroke:#f59e0b,stroke-width:2px,color:#000
style D fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff
style E fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff
style F fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff
style G fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style H fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style I fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style J fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
K[🔒 Defense:
Multi-Layer Limits] -.->|IP + User + Endpoint| C
L[🛡️ Defense:
Token Bucket] -.->|Adaptive throttling| G
M[⚙️ Defense:
CAPTCHA] -.->|Human verification| I
style K fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style L fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style M fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
📋 Attack Flow Breakdown
1
IP Rotation: Use proxies, VPNs, or cloud instances to rotate source IPs.
Request from: 1.2.3.4 → 5.6.7.8 → 9.10.11.12
2
Header Manipulation: Spoof X-Forwarded-For or Client-IP headers.
X-Forwarded-For: 192.168.1.1
X-Real-IP: 10.0.0.1
3
User-Agent Rotation: Change User-Agent strings to appear as different clients.
User-Agent: Mozilla/5.0 (Windows) → (Macintosh) → (Linux)
4
Distributed Attack: Use botnets or cloud infrastructure for parallel requests.
1000 AWS Lambda functions making concurrent requests
5
Session Token Rotation: Create multiple accounts to bypass user-based limits.
100 accounts × 100 requests each = 10,000 total requests
6
Exploit Race Conditions: Send parallel requests before rate limit updates.
Send 1000 concurrent requests simultaneously
7
Target Unprotected Endpoints: Find endpoints without rate limiting.
/api/public/* endpoints may lack protections
🛡️ Defense Mechanisms
✅ Multi-Layer Rate Limiting:
Implement limits at IP, user, session, and endpoint levels.
IP: 1000/hour | User: 500/hour | Endpoint: 100/minute
✅ Token Bucket Algorithm:
Use sophisticated algorithms that allow bursts but limit sustained abuse.
Bucket size: 100 | Refill rate: 10 tokens/second
✅ Device Fingerprinting:
Track unique device signatures beyond IP addresses.
Canvas fingerprinting, WebGL, Browser features
✅ CAPTCHA on Suspicious Activity:
Require human verification after threshold exceeded.
Trigger: After 10 failed login attempts
✅ Distributed Rate Limiting:
Use Redis or similar for cluster-wide rate limit tracking.
Redis INCR key:user:123:api:endpoint:timestamp
✅ Behavioral Analysis:
Detect automation patterns and anomalous behavior.
ML models: Request timing, pattern recognition
✅ API Keys with Rate Tiers:
Associate rate limits with authenticated API keys.
Free: 100/day | Pro: 10000/day | Enterprise: Custom