Finding a no-limit bug on the invite teammate page.

👋 Hello all👋

Rate limiting refers to the practice of controlling the number of requests that can be made to a service over a defined period. For instance, an API might allow only 100 requests per minute from a single user or IP address. If this limit is exceeded, the service will typically return an error message indicating that the rate limit has been surpassed.

So let’s see how I found this bug.

First, I clicked on Invite Teammates.

I entered a temp-mail email.

Before I click on send an invite.

I turned my proxy on.

I turned interception in burp suite.

After I clicked on Send invite.

You can see the request in the burp suite.

I sent it to Burp intruder.