Rotate X-Forwarded-For to bypass IP rate limiting

Crown Jewel Targets

Business logic vulnerabilities pay highest in platforms where financial transactions, identity verification, and access controls intersect with real-world consequences. The richest targets are:

• E-commerce & payment platforms (Valve/Steam, Shopify) — payment flow manipulation, free goods, price tampering
• Marketplace & gig economy apps (Airbnb, Uber) — identity/verification bypass enabling fraud or unsafe interactions
• SaaS with tiered access (Mozilla Monitor) — bypassing verification to unlock monitoring features without entitlement
• High-traffic consumer apps (Snapchat, Yelp) — rate-limit bypass enabling spam, enumeration, or abuse at scale

Asset types that pay: checkout flows, subscription endpoints, callback/verification systems, webhook handlers, employee/internal portals exposed to the internet, and any endpoint that trusts client-supplied data to make authorization decisions.

Attack Surface Signals

URL patterns to watch:

• /checkout, /order, /subscribe, /payment, /verify, /confirm, /callback
• /internal, /employee, /summit, /staff, /admin — internal pages accidentally public
• /api/v*/payment, /api/v*/notify, /webhook — payment provider callbacks
• Endpoints accepting X-Forwarded-For, X-Real-IP, CF-Connecting-IP headers

Response/header signals:

• Set-Cookie with unvalidated session state tied to cart or order data
• Payment provider names in responses: Smart2Pay, Stripe, PayPal, Braintree
• Redirect chains through third-party payment pages (in-flight data opportunity)
• 200 OK on subscription/verification endpoints with no CAPTCHA or token

JS patterns:

• Hardcoded internal URLs in frontend bundles (/employee/, /staff/, /internal/)
• Client-side price calculation before server submission
• Verification logic that only checks on the frontend (if (verified) { ... })
• fetch('/api/subscribe', { method: 'POST', body: ... }) with no anti-CSRF token or rate-limit token

Tech stack signals:

• Shopify storefronts with draft/unpublished channel pages
• Apps using IP-based rate limiting without session/account binding
• Payment webhooks with no HMAC signature validation
• SMS/phone callback flows that don't verify ownership before enabling features