Browse / RATELIMITED

RATELIMITED

See its reports on the map

Attack surface: 454 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to RATELIMITED

• Information Disclosure9
• Authentication6
• Access Control3
• Misconfiguration3
• Cross-site Scripting1
• Injection and Smuggling1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Subdomain takeover in GitLab Pages [george.ratelimited.me]Improper Restriction of Authentication Attempts · high
   59 votes
2. HTTP PUT method enabledImproper Access Control - Generic · critical
   44 votes
3. HTTP PUT method is enabled downloader.ratelimited.meImproper Restriction of Authentication Attempts · high
   40 votes
4. Missing Protection Mechanism in Mail Servers allows malicious user to use staff.ratelimited.me email could lead to identity theft.Violation of Secure Design Principles · high
   28 votes
5. Apache mod_negotiation filename bruteforcing https://api.ratelimited.meImproper Restriction of Authentication Attempts · low
   28 votes
6. Unrestricted File Upload on https://auth.ratelimited.meImproper Restriction of Authentication Attempts
   23 votes
7. Local File DownloadImproper Access Control - Generic · critical
   20 votes
8. HTTP PUT method is enabled ratelimited.meImproper Restriction of Authentication Attempts · critical
   19 votes
9. Exposure of tinyMCE js source code with plugin version disclosure which can leads to exploit further attacks.Information Disclosure · low
   18 votes
10. Credientals Over GET method in plain TextUnprotected Transport of Credentials · medium
    13 votes
11. Source code disclosure at ███Information Disclosure · high
    12 votes
12. xss in /users/[id]/set_tier endpointCross-site Scripting (XSS) - Reflected · medium
    11 votes
13. Banner Grabbing - Apache Server Version DisclousureInformation Disclosure · medium
    9 votes
14. Server Header disclose The Os and Web server Version Violation of Secure Design Principles
    9 votes
15. Cross Site Request Forgery in auth in https://auth.ratelimited.me/Cross-Site Request Forgery (CSRF) · medium
    7 votes
16. Information Disclosure on https://theendlessweb.com/Information Disclosure
    7 votes
17. Line feed injection in get request leads AWS S3 Bucket information disclosure Information Disclosure · medium
    5 votes
18. information disclosure which leak the apache version Information Disclosure · low
    2 votes
19. Information Disclosure PHPpgAdminInformation Disclosure