mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
58 lines
2.2 KiB
Markdown
58 lines
2.2 KiB
Markdown
# API Rate Limiting Bypass — API Reference
|
|
|
|
## Libraries
|
|
|
|
| Library | Install | Purpose |
|
|
|---------|---------|---------|
|
|
| requests | `pip install requests` | HTTP request sending with custom headers |
|
|
|
|
## Rate Limit Response Headers
|
|
|
|
| Header | Description |
|
|
|--------|-------------|
|
|
| `X-RateLimit-Limit` | Maximum requests per window |
|
|
| `X-RateLimit-Remaining` | Requests remaining in window |
|
|
| `X-RateLimit-Reset` | Timestamp when limit resets |
|
|
| `Retry-After` | Seconds to wait before retrying |
|
|
| `RateLimit-Policy` | IETF draft rate limit policy |
|
|
|
|
## IP Spoofing Bypass Headers
|
|
|
|
| Header | Description |
|
|
|--------|-------------|
|
|
| `X-Forwarded-For` | Standard proxy forwarding header |
|
|
| `X-Real-IP` | NGINX real client IP |
|
|
| `X-Originating-IP` | Client originating IP |
|
|
| `X-Client-IP` | Client IP identifier |
|
|
| `True-Client-IP` | Akamai/CDN client IP |
|
|
| `CF-Connecting-IP` | Cloudflare client IP |
|
|
| `Forwarded` | RFC 7239 forwarded header |
|
|
|
|
## Bypass Techniques
|
|
|
|
| Technique | Description | Severity |
|
|
|-----------|-------------|----------|
|
|
| Header IP rotation | Rotate X-Forwarded-For per request | HIGH |
|
|
| HTTP method switching | GET rate-limited but POST is not | MEDIUM |
|
|
| Path variation | `/api/users` vs `/api/users/` | MEDIUM |
|
|
| Case variation | `/API/Users` vs `/api/users` | MEDIUM |
|
|
| URL encoding | `%2Fapi%2Fusers` instead of `/api/users` | MEDIUM |
|
|
| Null byte injection | Append `%00` to URL path | HIGH |
|
|
| API version switching | `/v1/users` vs `/v2/users` | MEDIUM |
|
|
| Parameter pollution | Duplicate query parameters | MEDIUM |
|
|
|
|
## OWASP API4:2023 — Unrestricted Resource Consumption
|
|
|
|
| Risk | Description |
|
|
|------|-------------|
|
|
| Missing rate limits | No throttling on sensitive endpoints |
|
|
| Per-IP only limits | Bypassed with header spoofing |
|
|
| No auth-based limiting | Rate limit tied to IP, not user |
|
|
| Inconsistent enforcement | Different limits per method/version |
|
|
|
|
## External References
|
|
|
|
- [OWASP API Security Top 10](https://owasp.org/API-Security/)
|
|
- [IETF RateLimit Header Fields](https://datatracker.ietf.org/doc/draft-ietf-httpapi-ratelimit-headers/)
|
|
- [HackTricks Rate Limit Bypass](https://book.hacktricks.xyz/pentesting-web/rate-limit-bypass)
|