Lack of Rate Limiting in vAPI

Here we are again with another detailed walkthrough on another topic this time we will be talking about the Lack of rate limiting in vAPI.

Make sure your project (vAPI, Postman, Burpsuite) is installed and configured properly so we can directly head to exploitation.

When the API does not limit the number of requests from a specific API client, it is said to be lacking resources and rate limiting, such vulnerabilities help us to do brute force kind of attacks.

Let’s start our hunt by understanding the attack vector and analysing the request structure in Postman. From the request structure, we can understand that instead of username and password, this app is using an OTP-based log-in system. There are a total of 3 requests: one for generating OTP, one for authenticating OTP, and the last one for resource access.

We can see in the OTP generation request that one number is already filled and will be considered the standard one, so now that neither we have that number nor we can have OTP to get the resource access, what do we do now?

In the OTP verification request, we can see only OTP is getting sent as a parameter in the request body, and this is something interesting that we would like to dig into.

By following the given request order, we first sent an OTP-generating request, and to check for weakness, we sent multiple arbitrary OTP requests with random digits. Then we knew that we could send as many OTP authentication requests as we wanted, there is no rate-limiting mechanism in place to stop me from sending requests after some failed attempts. That’s what we wanted, this is a potential request that can be exploited by an intruder.

The third request is only for accessing resources after successful authentication.

First send an OTP generation request; for an OTP authentication request to work, it is essential. Then send an OTP authentication request and capture the request into the burp suite. send the request to the intruder and perform a brute force attack on the OTP value using the intruder.

one the attack is completed analyze responses with status codes other than 401.