429 Bypasser
Summary: PortSwigger's BApp Store lists a third-party Burp Suite extension called 429 Bypasser, version 1.0, authored by Iliya and last updated 03 April 2025, built to help penetration testers circumvent HTTP 429 rate-limiting mechanisms. The extension applies techniques including encoding, null bytes, and parameter pollution, targeting specified parameters or all parameters one by one by default, and adds a tab in Burp Suite where requests can be sorted by status code to identify which ones bypassed the limit.
Why it matters: A free, installable extension that automates 429 bypass through null bytes and parameter pollution means rate limits alone are not a control a security leader can count on against a determined tester or attacker, and PortSwigger states it makes no warranty about third-party extensions' quality or usefulness.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026