Build a script in python/bash/go for to check rate limit on websites
Budget: ₹1,500 – ₹12,500 INR
Rate Limiting
Check if websites have no rate limiting mechanism.
Main motive of this project is to find delay between the requests which stays under the radar of WAFs and thus doesn't block any of our requests when used other tools.
Website with no rate limit
Input: ./script url
Output: No rate Limit
Websites with WAF
Input: ./script url
Output: Delay x seconds
Test Plan;
1. Check if website has WAF (wafw00f tool github). If WAF found set delay to default 3 seconds.
2. Send 10 requests to url simultaneously. Check if request blocked by application. (403 Forbidden, Captcha)
3. If not send 20 request simultaneously. Check block.
4. Keep on increasing 30 requests afterwards. i.e 50 request in 3rd iteration. 80 in 4th. 110 in 5th.
5. If it reaches 200 requests without block. Set output as No rate limit.
6. If blocked by waf in any steps 1-5 wait for 2-3 minuts and try sending requests with slight delay. This is the delay value which we want to get back so that it can be used with other tools without hesitation
7. If blocked by WAF, try bypass mechanisms. Bypass mechanisms would sent later.
If none of the bypass mechanisms work, send back delay as 2/3 seconds
Check if websites have no rate limiting mechanism.
Main motive of this project is to find delay between the requests which stays under the radar of WAFs and thus doesn't block any of our requests when used other tools.
Website with no rate limit
Input: ./script url
Output: No rate Limit
Websites with WAF
Input: ./script url
Output: Delay x seconds
Test Plan;
1. Check if website has WAF (wafw00f tool github). If WAF found set delay to default 3 seconds.
2. Send 10 requests to url simultaneously. Check if request blocked by application. (403 Forbidden, Captcha)
3. If not send 20 request simultaneously. Check block.
4. Keep on increasing 30 requests afterwards. i.e 50 request in 3rd iteration. 80 in 4th. 110 in 5th.
5. If it reaches 200 requests without block. Set output as No rate limit.
6. If blocked by waf in any steps 1-5 wait for 2-3 minuts and try sending requests with slight delay. This is the delay value which we want to get back so that it can be used with other tools without hesitation
7. If blocked by WAF, try bypass mechanisms. Bypass mechanisms would sent later.
If none of the bypass mechanisms work, send back delay as 2/3 seconds