Skip to content

Brute Force & Rate Limit

Summary

Tools

  • ddd/gpb - Bruteforcing the phone number of any Google user while rotating IPv6 addresses.
  • ffuf/ffuf - Fast web fuzzer written in Go.
  • PortSwigger/Burp Suite - The class-leading vulnerability scanning, penetration testing, and web app security platform.
  • lwthiker/curl-impersonate - A special build of curl that can impersonate Chrome & Firefox.

Bruteforce

In a web context, brute-forcing refers to the method of attempting to gain unauthorized access to web applications, particularly through login forms or other user input fields. Attackers systematically input numerous combinations of credentials or other values (e.g., iterating through numeric ranges) to exploit weak passwords or inadequate security measures.

For instance, they might submit thousands of username and password combinations or guess security tokens by iterating through a range, such as 0 to 10,000. This method can lead to unauthorized access and data breaches if not mitigated effectively.

Countermeasures like rate limiting, account lockout policies, CAPTCHA, and strong password requirements are essential to protect web applications from such brute-force attacks.

Burp Suite Intruder

  • Sniper attack: target a single position (one variable) while cycling through one payload set.

    Username: password
Username1:Password1
Username1:Password2
Username1:Password3
Username1:Password4

  • Battering ram attack: send the same payload to all marked positions at once by using a single payload set.

    Username1:Username1
Username2:Username2
Username3:Username3
Username4:Username4

  • Pitchfork attack: use different payload lists in parallel, combining the nth entry from each list into one request.

    Username1:Password1
Username2:Password2
Username3:Password3
Username4:Password4

  • Cluster bomb attack: iterate through all combinations of multiple payload sets.

    Username1:Password1
Username1:Password2
Username1:Password3
Username1::Password4

Username2:Password1
Username2:Password2
Username2:Password3
Username2:Password4

FFUF

ffuf -w usernames.txt:USER -w passwords.txt:PASS \
     -u https://target.tld/login \
     -X POST -d "username=USER&password=PASS" \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -H "X-Forwarded-For: FUZZ" -w ipv4-list.txt:FUZZ \
     -mc all

Rate Limit

HTTP Pipelining

HTTP pipelining is a feature of HTTP/1.1 that lets a client send multiple HTTP requests on a single persistent TCP connection without waiting for the corresponding responses first. The client "pipes" requests one after another over the same connection.

TLS Stack - JA3

JA3 is a method for fingerprinting TLS clients (and JA3S for TLS servers) by hashing the contents of the TLS "hello" messages. It gives a compact identifier you can use to detect, classify, and track clients on the network even when higher-level protocol fields (like HTTP user-agent) are hidden or faked.

JA3 gathers the decimal values of the bytes for the following fields in the Client Hello packet; SSL Version, Accepted Ciphers, List of Extensions, Elliptic Curves, and Elliptic Curve Formats. It then concatenates those values together in order, using a "," to delimit each field and a "-" to delimit each value in each field.

  • Burp Suite JA3: 53d67b2a806147a7d1d5df74b54dd049, 62f6a6727fda5a1104d5b147cd82e520
  • Tor Client JA3: e7d705a3286e19ea42f587b344ee6865

Countermeasures:

  • Use browser-driven automation (Puppeteer / Playwright)
  • Spoof TLS handshakes with lwthiker/curl-impersonate
  • JA3 randomization plugins for browsers/libraries

Network IPv4

Use multiple proxies to simulate multiple clients.

proxychains ffuf -w wordlist.txt -u https://target.tld/FUZZ

  • Use random_chain to rotate each request

    random_chain

  • Set the number of proxies to chain per connection to 1.

    chain_len = 1

  • Finally, specify the proxies in a configuration file:

    # type  host      port
socks5  127.0.0.1 1080
socks5  192.168.1.50 1080
http    proxy1.example.com 8080
http    proxy2.example.com 8080

Network IPv6

Many cloud providers, such as Vultr, offer /64 IPv6 ranges, which provide a vast number of addresses (18 446 744 073 709 551 616). This allows for extensive IP rotation during brute-force attacks.

References