Rate-limit bypass
Get more attempts than the limiter intends - essential for brute-force, OTP and coupon/voucher abuse.
Tags: rate-limit, brute-force, otp
Techniques
Spoof client identity
Limiters keyed on a forwarded header reset their counter every request.
X-Forwarded-For: <rotating-ip>X-Real-IP: <rotating-ip>X-Forwarded-For: 127.0.0.1, <rotating-ip>
Path / case mutation
Per-path counters treat each variant as a fresh bucket.
/login vs /Login/login%00/login//login?x=<rand>
Verb / protocol change
Some limiters scope by method or are only wired on one protocol path.
GET ↔ POST on the same endpointHTTP/2 vs HTTP/1.1
Concurrency / race
Single-packet / last-byte sync lets a burst through before the counter updates (Turbo Intruder).
Fire N requests in parallel (single-packet attack)
Reset the window
Some flows reset the attempt counter on a new code issuance or new session.
Re-request the OTP to reset attemptsNew session per attemptNull/whitespace in the identifier