News for hackers. Stuff that matters.
Re:iViewed your API keys by cortesoft on Thursday April 14, 2022 @11:16AM (#31028059)
How do you know it wasn’t rate limited?
Re:iViewed your API keys by duskwuff on Thursday April 14, 2022 @03:44PM (#31032312)
Hardly matters. If an endpoint is leaking anything as sensitive as national ID + name + address, a determined attacker will have no problem with scraping it slowly or using a network of proxies to avoid rate limits.
Re:iViewed your API keys by AdamJacobMuller on Thursday April 14, 2022 @11:51AM (#31028573)
for((i=0;i<=99999999999;i++));do curl https://site.com/info.php?id=$i > $i.json done
Re:iViewed your API keys by callalex on Friday April 15, 2022 @12:35AM (#31036634)
This is a tangent, but curl has built-in support for “globbing”. For numeric ranges you can just put the range in [brackets] and it handles the rest.