Rate Limits
Programs cap scan rates and forbid techniques — obey YOUR $SCOPE_HOST policy or lose safe harbor.
Visual · bounty_rate_limits
Rate limits + forbidden actions. $SCOPE_HOST only. Original Cyberlium.
Aggressive scanning on production is how researchers get banned — read limits first.
Program policies specify rate limits (requests per second, concurrent connections), forbidden actions (DoS, brute force on auth, spam, privacy violations, social engineering), and testing account rules. Violating these voids safe harbor even on in-scope $SCOPE_HOST assets. Cyberlium teaches limit literacy — not dorm sweeps disguised as 'rate limit practice.' You will NOT run credential stuffing on café login pages because a program allows 'authentication testing' on $SCOPE_HOST. Next: Scope Lab.
1. Rate limits protect production
Common rules: max N requests/second, no automated scanning on certain endpoints, throttle during business hours. Log your tool settings beside scope date in notes.
Lab practice at $LAB_HOST can use higher rates — production $SCOPE_HOST gets policy rates only.
Command guide
Try these commands — Rate limits protect production
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Scope env — SCOPE_HOST drives all recon commands lab.example.invalid — safe placeholder until program joined
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t20-scope.env" 2>/dev/null || SCOPE_HOST=httpbin.org
curl -sS "https://${SCOPE_HOST}/" -I --max-time 10 2>/dev/null | head -10 || curl -sS -I https://httpbin.org/ | head -10Primary tools to practice this lesson: curl, jq. Reference sites: Scope env; lab.example.invalid. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Forbidden actions are non-negotiable
Typical bans: denial of service, mass mailing, downloading excessive user data, physical attacks, social engineering staff, testing on other users' accounts without authorization. Read the exact forbidden list for YOUR program.
Forbidden on $SCOPE_HOST does not mean 'try it on classmate deploy instead.'
3. Safe harbor requires limit compliance
Researchers who exceed limits or run forbidden tests lose platform standing and legal protection. Document your throttle settings before recon on $SCOPE_HOST.
Ship: rate limit line + three forbidden actions from YOUR policy. Next: Scope Lab.
4. What you ship: rate limits and forbidden actions list
Rate limit numbers, three forbidden actions, tool throttle note. $SCOPE_HOST only. chmod 600.
5. What you record before the next lesson
Date. Rate limits + forbidden list. $SCOPE_HOST named. File t20-m03-l03-rate-limits.txt chmod 600.
6. Wrong vs right: random sites vs in-scope program
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Run full port scan at max speed on production $SCOPE_HOST. Brute force café Wi-Fi portal 'for auth testing practice.'
- Right: Document limits and forbidden actions for YOUR program. Next: Scope Lab.
Mission: extract limits from YOUR policy
1) Copy rate limit lines from $SCOPE_HOST policy. 2) List three forbidden actions. 3) Write tool throttle you will use. 4) chmod 600. Never exceed limits on production scope.
Stuck? Ask Cyberlium AI Mentor
Slow recon on scope beats fast ban from triage.
APPLY: Rate limits on $SCOPE_HOST exist to:
APPLY: True or False: Forbidden actions in policy apply only to out-of-scope hosts.
APPLY: Credential stuffing on café login is: