rate-limiting-and-resource-abuse

仓库创建 2026年7月26日最近提交 1 天前SkillHot 收录 10 小时前

▸ 精选理由

聚焦高成本滥用场景，适合防御策略与红队评估。

▸ 风险提示

包含压力测试方法，可能影响可用性，需谨慎并获授权。

这个 Skill 做什么

检测 API 是否缺乏限流与资源保护，防止暴力、爬取和计费滥用。

帮你检测 API 有没有限流和资源保护，防止单个客户端暴力破解、全量爬取或把账单打爆的滥用行为。任何对外开放的接口、特别是消耗大或能导出数据的端点都应该跑这个检测。除了找问题，还会建议加上限流、配额、速度策略和更严格的认证与监控措施来补洞。

▸ 展开 SKILL.md 英文原文

Use when testing whether an API limits how often and how heavily it can be called — the missing controls that enable brute force, scraping, and cost/DoS attacks.

开发编程限流滥用DoS通用

Stars

Forks

仓库内 Skill

积累中

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/jihedbfr-art/cyber-skills/main/skills/04-api-security/04-rate-limiting-and-resource-abuse/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/jihedbfr-art/cyber-skills/main/skills/04-api-security/04-rate-limiting-and-resource-abuse/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

## Purpose

Without limits, an API lets a single client do unlimited work: brute-force credentials, scrape the whole dataset, or drive up compute and bandwidth until the service (or the bill) falls over. This skill covers testing for missing or weak rate limiting and resource controls, and how to add them.

## When to use it

Any exposed API, especially endpoints that are expensive (search, export, report generation), sensitive (login, OTP, password reset), or that return lots of data. Also any endpoint whose cost scales with a client-supplied parameter (page size, date range).

Do this within scope and gently — the whole point is resource exhaustion, so uncontrolled testing can cause the ve

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有