Scribd Logo
Upload

Welcome to Scribd!

  • Lack of Resource and Rate Limiting: Gavin Johnson-Lynn

    Uploaded by

    Oluwaseun Ogunrinde
    58 views16 pages
    This document discusses resource and rate limiting vulnerabilities in APIs. It presents how lack of limits on resources like file uploads, password attempts, and database queries can strain servers and potentially cause denial of service. It recommends common defenses like throttling requests by user, limiting concurrent requests, and restricting things like file sizes, password attempts, and database query parameters through input validation.

    Original Description:

    Original Title

    lack-of-resource-and-rate-limiting-slides

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    This document discusses resource and rate limiting vulnerabilities in APIs. It presents how lack of limits on resources like file uploads, password attempts, and database queries can strain servers and potentially cause denial of service. It recommends common defenses like throttling requests by user, limiting concurrent requests, and restricting things like file sizes, password attempts, and database query parameters through input validation.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    58 views16 pages

    Lack of Resource and Rate Limiting: Gavin Johnson-Lynn

    Uploaded by

    Oluwaseun Ogunrinde
    This document discusses resource and rate limiting vulnerabilities in APIs. It presents how lack of limits on resources like file uploads, password attempts, and database queries can strain servers and potentially cause denial of service. It recommends common defenses like throttling requests by user, limiting concurrent requests, and restricting things like file sizes, password attempts, and database query parameters through input validation.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    of 16

    Lack of Resource and Rate Limiting

    Gavin Johnson-Lynn
    SOFTWARE DEVELOPER, OFFENSIVE SECURITY SPECIALIST

    @gav_jl www.gavinjl.me
    Overview Resources in an API
    Abusing missing limits
    Vulnerability impacts
    Common defenses
    Throttling requests
    Simultaneous requests are expected
    What Is It?
    Each API request uses resources
    Too many requests cause problems
    Request Resources
    Exploitability

    Making requests is enough


    Usually from authenticated users
    Load test tools
    - E.g. JMeter
    - From a single machine
    - From multiple machines
    Large File Upload

    Upload feature
    Strain on resources
    Disk space
    Memory (RAM)
    Password Brute Force

    Incorrect password
    - Several tries
    - Is it really the user?

    Unlimited guesses
    - Automated tools
    - Common password lists
    Query Parameter Tampering

    Request large amount


    of records
    Filter records
    Page size
    Complex database
    queries
    Query Parameter Tampering Attack

    https://.../Content?page=2
    1 &PageSize= 1000000
    100

    Response:
    [
    {record101…}
    {record1…}
    {record2…}
    {record102…}
    …
    {record100}
    {record999999…}
    {record200}
    ]
    Prevalence

    Occurs in a variety of ways


    Load testing
    - Put API under load
    - Highlight potential problems
    Detectability

    Common failure points


    - Invalid passwords
    - File uploads
    - Data queries

    Slow responses
    Technical Impact

    Denial of service (DoS)


    Slow responses
    Overwhelmed database
    Denial of wallet
    Defense – Rate Limiting

    Request throttling
    - Limit requests in a time period
    - Error if exceeded – HTTP 429

    Request throttling in the cloud


    - Azure API management
    - AWS API gateway

    Authenticated users are easily throttled


    Anonymous users can be harder
    Defense – Authentication

    Anonymous access to authentication


    Limit number of login attempts
    - 3-5 guesses before locking

    Lock accounts
    - Minimum should be minutes
    - Maximum should be contact admin
    Defense

    File upload defense


    - Config to limit request size
    - Use caution if increasing

    Paged query defense


    - Works only when trusting user input
    - NEVER trust use input!
    - Validate maximum page size

    Input validation on all fields from client


    Presents in various ways
    Consider how it presents in your API
    Summary
    Impact
    - Slows down API
    - DoS
    - Denial of wallet

    Defenses
    - Limit resource impact
    - Request throttling

    You might also like