# Web Authentication Endpoint Credentials Brute-Force Vulnerability

HackerOne login rate-limited only per-IP; rotating 677 IPv6 addresses from one VPS bypassed it, brute-forcing 10k passwords at ~30/s.

- Payout: hidden
- Severity: medium
- Program: HackerOne
- Found by: arneswinnen
- Disclosed: 2016-06-23
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/127844
- Library page: https://bugbountylibrary.com/r/h1%3A127844
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:medium tech:rest technique:recon vuln:auth-bypass vuln:business-logic

**Target:** Web authentication endpoint (POST /sessions)
**Root cause:** Login brute-force protection relied solely on per-IP request rate-limiting (block after requests faster than every 4s), with no account-level lockout or pre-auth captcha.
**Steps:**
1. Observe POST https://hackerone.com/sessions blocks requests faster than every 4s from one IP.
2. Provision a VPS with a /64 IPv6 range; assign 500+ IPv6 addresses to the interface (`ifconfig` shows many `2a04:XXXX:0:32::10xx/64`).
3. Run a Python brute-force script rotating through the 677 interfaces with 50 threads, keeping ≥4s between reuse of each IP.
4. Feed `10k_most_common.txt` (appended with the real password) against the target account; achieve ~30 pw/s.
5. Script reports `[SUCCESS] Found the right password: Geniaal2!!` after 335s; log in with no additional validation.
**How found:** Noticed the only defense was IP-based rate-limiting, then reasoned that a /64 IPv6 allocation gives effectively unlimited distinct source IPs; tested TOR (blocked by Cloudflare) then pivoted to IPv6 VPS rotation.
**Exploitation:** Attacker rents a cheap VPS with a /64 IPv6 subnet, assigns hundreds of source addresses, and rotates them per login attempt so each IP stays under the rate limit, enabling unlimited-speed online password guessing against any account.
**Escalation:** Scaling source IPs (botnets, cloud EIPs, VPNs, proxies) removes the rate-limit ceiling entirely; dictionary attacks against reused passwords could compromise many accounts and expose confidential bug reports.
**Insight:** When a login endpoint rate-limits per source IP, check whether the host is reachable over IPv6 and whether your VPS provider gives a /64 — rotating addresses within the subnet defeats per-IP throttling without any botnet.