Parser and control bypass reference

Rate-limit bypass

Get more attempts than the limiter intends - essential for brute-force, OTP and coupon/voucher abuse.

rate-limitbrute-forceotp
Stable IDbypass:rate-limitLast updatedLast verifiedLegacy review pendingProvenanceCurated reference
Compare behaviorA bypass claim needs a control request and a clear boundary that changed.

Stop after confirmation. Do not escalate impact without separate authorization.

Spoof client identity

Limiters keyed on a forwarded header reset their counter every request.

  • X-Forwarded-For: <rotating-ip>
  • X-Real-IP: <rotating-ip>
  • X-Forwarded-For: 127.0.0.1, <rotating-ip>

Path / case mutation

Per-path counters treat each variant as a fresh bucket.

  • /login vs /Login
  • /login%00
  • /login/
  • /login?x=<rand>

Verb / protocol change

Some limiters scope by method or are only wired on one protocol path.

  • GET ↔ POST on the same endpoint
  • HTTP/2 vs HTTP/1.1

Concurrency / race

Single-packet / last-byte sync lets a burst through before the counter updates (Turbo Intruder).

  • Fire N requests in parallel (single-packet attack)

Reset the window

Some flows reset the attempt counter on a new code issuance or new session.

  • Re-request the OTP to reset attempts
  • New session per attempt
  • Null/whitespace in the identifier

Version history: normalized permanent page created 2026-08-20.