Rate-Limit Bypass Simulator
A login endpoint that blocks you after 3 bad guesses — but trusts a header you control to decide who "you" are.
A login that locks you out after three bad guesses, and a rate limiter that decides who "you" are from a header you control. This is one of the most common real misconfigurations behind a proxy.
How to use it
- Trigger the lockout with bad guesses.
- Notice which header identifies you.
- Change it and continue guessing.
What to take away
X-Forwarded-For is client-supplied
It is a hint added by proxies and freely forged by anyone. Trusting it for identity means trusting the attacker.
Trust only your own proxy
Take the client address from the connection, or from the specific position in the header chain your own trusted proxy wrote.
Rate limit the account too
Limiting only by address lets a distributed attack through. Password spraying — one password against thousands of accounts — is designed to stay under per-address limits.
Frequently asked questions
Should rate limiting be by IP or by account?
Both. Per-address stops one machine hammering you; per-account stops a distributed attack on a single user; global limits catch spraying across many.
Is rate limiting enough to protect a login?
No. It buys time. Multi-factor authentication, breach-password screening and anomaly detection are what actually stop credential attacks.
Where this fits in the course
This security lab pairs with Path 21 — API Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Password Cracking Lab — Four hashed passwords, one wordlist. See exactly which ones fall to a dictionary attack and which survive it — and why.
- BOLA/BFLA Playground — A fake employee-directory API. Read a record that isn't yours, then call an admin-only action with no admin role at all.
- Race Condition Lab — A one-time coupon, redeemed with a check-then-act flaw. Fire requests fast enough and redeem it far more than once.
- Password Policy Checker — Test a password against a configurable length/complexity policy, rule by rule.