All Projects

Description The login endpoint implements rate limiting to prevent abuse, but it appears ineffective . Sending 100+ requests with null/empty payloads via Burp Intruder results in consistent 200 OK responses without triggering 429 . A correct password yields 302 (redirect, indicating success).

Affected Asset:https://admin.alwaysdata.com/login

Steps to Reproduce

1.Navigate to the login page (https://admin.alwaysdata.com/login).
2.Use Burp Suite Intruder to send 100+ requests with null/empty payloads
3.Observe 200 OK responses for all, no 429.
4.Test a valid credential: Receives 302.

Impact

Allows potential brute-force on passwords without reliable blocking.
Minor resource consumption from repeated requests.