Missing Rate Limiting

Brute Force Attacks • Intermediate

Authentication

Secure Mode• show fix Session• Cookie Recruiter• Mode

Objective: Attempt repeated logins without restriction.

Try: Increase the number of attempts.

⏱️ Design: Security changes with time and volume—watch the attempt behavior.

Everything here is simulated and sandboxed to this site—no real accounts, no real services.

Demo How it works Issue Exploit Fix Video

1) Demo

Here is the feature “working” as implemented in this mode.

App Output

Attempt Timeline

▶ attempt 1

Server response: 666 Oh! That's ummm... ✨le unauthorized✨

Response

Status: 666 Oh! That's ummm... ✨le unauthorized✨ Response Headers: (none)

2) How the code works

This section shows the mental model: what the server is “thinking”.

// no rate limiting if (!checkPassword()) return 401;

3) The issue

Unlimited password guessing enables brute force attacks.

Real-world impact: Attackers can try thousands of passwords until one works.

4) Exploit it

Edit the raw request below. You can change method, path/query, headers, and body. Then send it. The server will parse what you typed and re-run the simulation.

Request Editor

Tip: For secure mode tests, add a cookie like: Cookie: session=1; role=Admin

Parsed View (what the server read)

method: POST path: /login?attempt=1 headers: host: kylerburke.dev content-type: application/x-www-form-urlencoded body: username=admin&password=wrongpass

Exploit Editor Hidden (Recruiter Mode)

This mode is designed for sharing your portfolio. It focuses on clear explanation, real-world impact, and fixes—without interactive exploitation.

Want to demo the exploit? Turn Recruiter Mode off and use the Request Editor.

5) Fix

Secure Mode shows the fix behavior. Flip modes and send the same request.

Add rate limits, lockouts, MFA, and monitoring.

Video

Short visual explanation to match what you just did.

Swap the YouTube ID in the Worker to pick a different explainer video for this vulnerability.