POST /login or POST /send-otp returning 429 Too Many Requests.
Test by rotating headers per request: X-Forwarded-For: 1.1.1.1, X-Real-IP, X-Originating-IP, X-Client-IP, CF-Connecting-IP, True-Client-IP - or path tricks like /login, /login/, /login%00, /Login, /api/v1/login vs /api/v2/login.
If the limit resets with each spoofed value, it may indicate Rate Limit Bypass, enabling brute-force of passwords, OTPs, or coupon codes at scale.
For more tips join our Telegram channel: https://t.me/bugbountyusa
Top comments (0)