Rate Limit Testing

Rate limiting is a strategy used to control the amount of incoming or outgoing traffic. It helps protect systems from abuse and ensures fair resource distribution.

Purpose: This guide explains how to verify that rate limiting is correctly implemented and enforced in your application.

Testing

1. Rapid Request Test

for i in {1..20}; do curl -s -o /dev/null -w "%{http_code}\n" https://vergedge.lol; done

Replace: https://vergedge.lol → your target URL

What it does : Sends 20 quick HTTP requests to the target server.

Purpose : To detect if the server imposes limits (like 429 errors) after a rapid burst of requests from a single IP.

Panel Screenshot

Terminal

2. Header Spoofing to Bypass IP Rate Limit

for i in {1..50}; do curl -s -o /dev/null -w "%{http_code}\n" -H "X-Forwarded-For: 1.2.3.4" https://vergedge.lol; done

Replace : 1.2.3.4 → a fake IP address (random private/public IP)

https://vergedge.lol → your target URL

What it does : Fakes the client IP by injecting an X-Forwarded-For header.

Purpose : To test if rate limiting is applied only based on IP, and whether spoofing can bypass it. 

Terminal

3. User-Agent Rotation

for i in {1..50}; do curl -s -o /dev/null -w "%{http_code}\n" -A "Mozilla/5.0 (Custom)" https://vergedge.lol; done

Replace : "Mozilla/5.0 (Custom)" → any User-Agent string

https://vergedge.lol → your target URL

What it does : Sends a request with a custom User-Agent header.

Purpose : To determine if rate limits are tied to the User-Agent and can be bypassed  using header variations. 

Terminal

Conclusion

Rate limiting is a critical mechanism to protect APIs and web services from abuse, overuse, and denial-of-service attacks. Through testing with curl, the following was validated:

• 429 responses were observed when request thresholds were exceeded, confirming that rate limiting is active.

• Burst tests, throttled requests, and header manipulation (e.g., X-Forwarded-For, User-Agent) helped confirm whether rate limiting was based on IP, User-Agent, or other identifiers.