Rate-limit bypass

When it applies

An endpoint limits attempts (login, OTP/2FA, password reset, coupon, search) and you need more attempts than allowed — to brute force, guess a code, or enumerate. The limit is the only control standing between you and the bug.

Why it works

Rate limits are enforced on a key the attacker can often change or spoof: an IP header, a session, an account id, or a per-endpoint counter. If the key is attacker-controlled or the limit is inconsistent across paths/casing, you reset or dodge the counter.