Lack of Rate Limiting | writeups.xyz

Title	Vulnerabilities	Programs	Authors
My first and last crit of 2020 on Hackerone	Lack of Rate Limiting Bruteforce IDOR Password Reset Account Takeover	Undisclosed	Takester (@Dhiraj_ramteke)
Finding bugs on Chess.com	Lack of Rate Limiting Bruteforce CSRF	Chess.com	Seqrity (@Seqrity9)
Chaining vulnerabilities lead to account takeover	Account Takeover Password Reset Open Redirect Lack of Rate Limiting	Undisclosed	Ahmed (@Ahzsec)
Story of an interesting bug.	Lack of Rate Limiting DoS	Undisclosed	Vedant Tekale (@_JustYnot)
5 Ways to do Account Takeover in a Single Website	Account Takeover Lack of Rate Limiting OTP Bypass IDOR OAuth JWT	Undisclosed	Letmeslidein (@VasuYadaav)
Chains on Chains: Chaining multiple low-level vulns into a Critical.	Blind XSS CSP Bypass Lack of Rate Limiting Exposed JWT Generation Endpoint JWT	Undisclosed	Daniel Marte (@Masonhck3571)
Zoom Security Exploit – Cracking private meeting passwords	CSRF Lack of Rate Limiting	Zoom	Tom Anthony (@TomAnthonySEO)
How I bypassed 2fa in a 3 years old private program!	2FA / MFA Bypass Bruteforce Lack of Rate Limiting	Undisclosed	Shivangx01b (@Shivangx01b)
Chaining rate limiting for account lockout	Lack of Rate Limiting	Undisclosed	Sandip Oli
Android pin bypass with rate limiting	Lack of Rate Limiting Authentication Bypass	Undisclosed	Baluz (@T3chman)
The 3 Day Account Takeover	Logic Flaw Password Reset Account Takeover Bruteforce Lack of Rate Limiting	Undisclosed	Mr. Beast (@__Mr_beast__)
Bypass 2FA like a Boss	Lack of Rate Limiting Bruteforce	Undisclosed	Seqrity (@SeQrity)
How I managed to Escalate privilege as admin	Lack of Rate Limiting Bruteforce Weak Credentials	Undisclosed	Abisheik Magesh (@AbisheikMagesh)
Account Takeover via OTP Bruteforce (Apigee API)	OTP Bypass Bruteforce Lack of Rate Limiting	Undisclosed	Vishnuraj
How I got access to critical data of a Company in no time ?	Information Disclosure Lack of Rate Limiting Bruteforce	Undisclosed	Kaustubh Kale
Ability to bruteforce Instagram account’s password due to lack of rate limitation protection	Lack of Rate Limiting Bruteforce	Meta / Facebook	Youssef Sammouda (@Samm0uda)
How I discovered an interesting account takeover flaw?	Account Takeover Password Reset Lack of Rate Limiting	Undisclosed	Akash Methani (@0xAkash)
No Rate Limit - 2K Bounty	Lack of Rate Limiting	Yahoo! / Verizon Media	Shrey Shah (@ShreySh43332033)
BugBounty: How I Cracked 2FA (Two-Factor Authentication) with Simple Factor Brute-force !!! 😎	2FA / MFA Bypass Lack of Rate Limiting	Undisclosed	Akash Agrawal (@Akashmagrawal)
Oculus identity verification bypass through brute-force	OTP Bypass Lack of Rate Limiting	Meta / Facebook	Karthik Kumar Reddy (@Karthiksunny007)
No Rate limiting eligible for bounty ?	Lack of Rate Limiting	Undisclosed	Smaran Chand (@Smaranchand)
Facebook Informative Bug From Triaged	Lack of Rate Limiting	Meta / Facebook	Circle Ninja (@Circleninja)
[sidefx][Poc] user enumeration & no rate limeted in send message function	Username Enumeration Lack of Rate Limiting	SideFX	Abdelhak Kharroubi
Bug Bounty 101 — Always Check The Source Code	Lack of Rate Limiting Information Disclosure	Undisclosed	Spazzy
Bruteforce Instagram account’s passwords (lack of rate limiting protection).	Bruteforce Lack of Rate Limiting	Meta / Facebook	Youssef Sammouda (@Samm0uda)

Page 2 of 3