API2:2023 — Broken Authentication

Slide 11 · Brute Force + No Lockout

If you'll try every key, you only need the lock.

No rate limit. No lockout. No CAPTCHA. An API is a perfect brute force target.

How It Works

Unlike credential stuffing, brute force doesn't need a stolen password list. It tries every possible combination — or a dictionary of common passwords — against a single account.

Against a login API with no protection, a script can try tens of thousands of passwords per minute. A 6-digit numeric PIN has one million combinations. At 10,000 attempts per minute, that's 100 minutes to guarantee success.

# GraphQL batching bypass example POST /graphql [ {"query": "mutation { login(user: "victim@x.com", pass: "password1") { token } }"}, {"query": "mutation { login(user: "victim@x.com", pass: "123456") { token } }"}, {"query": "mutation { login(user: "victim@x.com", pass: "qwerty") { token } }"}, ... 97 more attempts in this single HTTP request ]

The GraphQL trick

Rate limiting often counts HTTP requests, not individual queries inside them. GraphQL allows sending an array of queries in a single request — called query batching.

100 login attempts, 1 HTTP request. The rate limiter sees 1. The login endpoint processes 100. This bypass works on any GraphQL API that allows batching without counting inner operations.

← Back Broken token validation →