# Web Rate Limit Bypass

> Bypass rate limits and anti-automation to enable brute force, OTP guessing, coupon abuse, and enumeration. Load when an endpoint is throttled (429/"too many attempts"), on login/OTP/reset, or "rate limit". Signals: 429 responses, lockout messages, per-account throttling, OTP/2FA.

- Skill: `noorqureshi/web-rate-limit-bypass` (Agent Skill)
- Install (CLI): `npx skillmds@latest add noorqureshi/web-rate-limit-bypass`
- Raw SKILL.md: https://api.skillmd.com/api/skills/noorqureshi/web-rate-limit-bypass/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: NoorQureshi (https://skillmd.com/u/noorqureshi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/noorqureshi/web-rate-limit-bypass

---


# Rate-limit bypass

## When it applies
An endpoint limits attempts (login, OTP/2FA, password reset, coupon, search) and you need more
attempts than allowed — to brute force, guess a code, or enumerate. The limit is the only control
standing between you and the bug.

## Why it works
Rate limits are enforced on a key the attacker can often change or spoof: an IP header, a session,
an account id, or a per-endpoint counter. If the key is attacker-controlled or the limit is
inconsistent across paths/casing, you reset or dodge the counter.

## Method
1. **Find the key**: is the limit per-IP, per-account, per-session, or global? Change it:
   - **IP spoof headers**: `X-Forwarded-For`, `X-Real-IP`, `X-Client-IP`, `X-Originating-IP` —
     rotate values per request; many WAFs/apps trust these.
   - **Session/token**: rotate cookies/CSRF tokens; unauthenticated vs authenticated paths.
2. **Path/param tricks**: case (`/Login`), trailing `/`, added query params, HTTP/2 multiplexing,
   or a different endpoint that hits the same backend without the limit.
3. **Race the window**: fire a burst in parallel before the counter updates (→ `web-race-conditions`),
   e.g. many OTP guesses at once.
4. **Automate** with Burp Intruder / `ffuf`, injecting a rotating `X-Forwarded-For` per request.

## Gotchas
- Confirm attempts actually go through (watch for silent drops that return 200 but don't count).
- OTP brute needs the code space small enough (4–6 digits) and no per-account lockout — check both.
- Respect program RoE — brute force is noisy; throttle and stop once the bypass is proven.

## Verify success
Attempts continue past the documented limit (no 429), demonstrated by a successful brute/OTP guess
or sustained enumeration that the limit should have blocked.

## References
OWASP API Security (API4); PortSwigger auth/OTP labs; OWASP WSTG anti-automation.