Parser and control bypass reference
Rate-limit bypass
Get more attempts than the limiter intends - essential for brute-force, OTP and coupon/voucher abuse.
Compare behaviorA bypass claim needs a control request and a clear boundary that changed.
Stop after confirmation. Do not escalate impact without separate authorization.
Spoof client identity
Limiters keyed on a forwarded header reset their counter every request.
X-Forwarded-For: <rotating-ip>X-Real-IP: <rotating-ip>X-Forwarded-For: 127.0.0.1, <rotating-ip>
Path / case mutation
Per-path counters treat each variant as a fresh bucket.
/login vs /Login/login%00/login//login?x=<rand>
Verb / protocol change
Some limiters scope by method or are only wired on one protocol path.
GET ↔ POST on the same endpointHTTP/2 vs HTTP/1.1
Concurrency / race
Single-packet / last-byte sync lets a burst through before the counter updates (Turbo Intruder).
Fire N requests in parallel (single-packet attack)
Reset the window
Some flows reset the attempt counter on a new code issuance or new session.
Re-request the OTP to reset attemptsNew session per attemptNull/whitespace in the identifier
Version history: normalized permanent page created 2026-08-20.