MFA / OTP
Skip, tamper, and race probes. Do not brute a production OTP pool past the program's rate-limit rule.
Tags: 2fa, otp, ato
Controlled probes
{"mfa_required":false}{"otp":"000000"}POST /api/session (skip /mfa/verify)code=000000&code=000001 (HPP)HTTP/2 burst of /mfa/verify
Source: https://owasp.org/www-project-web-security-testing-guide/