skills.rest
inventashif
inventashifCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-brute-force

Tests authentication endpoints for missing rate limiting, OTP brute force, and user enumeration.

Updated Sep 6, 2026
Search Tags:#rate limiting#penetration testing#brute force#bug bounty#user enumeration#account takeover#otp bypass
One-click install
npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-brute-force-inventashif
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-brute-force
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/hunt-brute-force
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-brute-force-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? It guides security researchers through detecting missing or weak rate limiting on login, OTP, and password-reset endpoints during authorized bug bounty testing, avoiding false negatives caused by shadow throttling. ## Core Features & Use Cases - Four-State Rate-Limit Classification: Distinguishes hard lockout, soft IP throttle, CAPTCHA injection, and silent shadow-throttling instead of naively checking for HTTP 429 responses. - OTP and Token Brute Methodology: Provides phased curl, ffuf, and hydra workflows for OTP keyspace reachability math, token entropy measurement, and X-Forwarded-For IP-rotation bypass testing. - Enumeration and ReDoS Detection: Covers username/email enumeration via string, status, and timing oracles, plus super-linear latency testing for catastrophic-backtracking regex flaws. - Use Case: While testing a web app's login flow in a bug bounty program, run the 50-request burst probe, classify the defense state, and prove an IP-rotation bypass by toggling header rotation and showing the 429 returns. ## Quick Start Ask the AI to test the target's login and OTP verification endpoints for missing rate limiting using the phased brute-force hunting methodology.

Frequently Asked Questions about hunt-brute-force

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for missing rate limiting on a login endpoint?▼

Send a burst of roughly 50 requests with wrong credentials while logging status code, latency, and body length for each attempt. Then classify the defense as hard lockout, soft IP throttle, CAPTCHA injection, or silent shadow-throttling rather than only checking for HTTP 429 responses.

How to brute force OTP verification endpoints in bug bounty testing?▼

First send a 101-code probe to confirm the endpoint accepts repeated attempts without 429 or lockout, then run a shadow-throttle seed test with a known-good code. Severity depends on reachability math: sustained throughput multiplied by code lifetime must approach the 10^6 keyspace.

Why does a missing 429 response not prove rate limiting is absent?▼

Many applications use silent shadow-throttling, returning normal 200 or 401 responses while dropping submissions server-side. Confirm by injecting a known-good credential mid-burst and verifying it still authenticates under load.

Can X-Forwarded-For headers bypass IP-based rate limits?▼

Yes, when the application trusts client-controlled source headers like X-Forwarded-For, X-Real-IP, or True-Client-IP. Rotate a random IP per request, then confirm the bypass by disabling rotation and showing the 429 response returns.

How do I detect username enumeration through timing attacks?▼

Compare median response times for valid versus invalid usernames across at least 20 to 30 samples each. Valid accounts typically trigger password hashing while invalid ones short-circuit, producing a reproducible timing delta that indicates enumeration.

What tools does this methodology use for brute force testing?▼

It uses curl for phased manual probes, ffuf with auto-calibration for OTP fuzzing, hydra for login spraying, nuclei for default-credential templates, and Burp Sequencer or ent for measuring token entropy.

Related Skills

Explore More Software Engineering Skills→
Niranjan-githubsNiranjan-githubs

attack-surface-discovery

Automate web application attack surface discovery with an 18-phase pipeline.

Community
Advanced
marcboggsmarcboggs

report-writing

Writes impact-first bug bounty reports for HackerOne, Bugcrowd, Intigriti, and Immunefi with CVSS scoring.

Community
Intermediate
cybersecwomancybersecwoman
5

hunt-ato

Identify and analyze account takeover vulnerabilities in web applications.

Community
Advanced
uphiagouphiago
1.1k

hunt-brute-force

Classify rate limit defense states and test brute force feasibility on authentication endpoints.

Community
Advanced