Rate-Limit Bypass Tool: Whitepass

Cyber Struggle Delta Team has developed a tool to test bypasses against whitelist and rate-limit implementations in web applications and APIs.

Main Features

• Parse requests exported from Burp Suite
• Customize the request
• Add additional headers
• Add additional payloads
• Add known IP addresses for the target

How It Works

Whitepass fuzzes the target with additional HTTP headers. Unlike tools limited to headers such as X-Originating-IP or X-Forwarded-For, Whitepass uses more than 70 HTTP headers with multiple payloads. It evaluates bypass methods against whitelist and rate-limit controls implemented by applications, APIs and web servers. The project originated as one of Delta Team’s internal engagement tools.

# Python 3.6+ required
python3 whitepass.py -r burp_saved_request
 
# Test an HTTP POST request
python3 whitepass.py -u https://api.company.com/v1/api/login -m post --data "username=test&password=test"
 
# Test a simple HTTP GET request
python3 whitepass.py -u https://api.company.com/v1/api/login
 
# Test a list of endpoints
python3 whitepass.py -l list.txt
 
# Display usage information
python3 whitepass.py --help

The project is available in the Whitepass GitHub repository.