hunt-brute-force

1# HUNT-BRUTE-FORCE — Rate Limiting / Brute Force / Enumeration
2 
3> Grounding note: this skill is built from published technique classes, not from a
4> curated set of named HackerOne reports. `report_count` is intentionally `0` — do
5> not cite an exact payout or report ID you cannot verify. Where a public case is
6> well-documented (e.g. Laxman Muthiyah's Instagram password-reset OTP race/rotation
7> research, 2019–2021), it is named below as a *technique reference*, not a payout claim.
8 
9## Crown Jewel Targets
10 
11OTP brute force (6-digit = 1,000,000 combinations) with no effective rate limit = Critical ATO bypass.
12 
13**Highest-value chains:**
14- **OTP / 2FA brute → MFA bypass → ATO** — no effective rate limit on `/verify-otp`, full 000000–999999 keyspace reachable
15- **Password-reset token brute** — short/predictable/non-expiring tokens + no rate limit → ATO (the Instagram 2019 case combined a 6-digit reset code, no rate limit per request-source, and IP rotation to make 10^6 tractable)
16- **Username/email enumeration → targeted credential stuffing** — valid/invalid distinguishable by response string, status code, or timing, then sprayed with breach corpora
17- **Coupon / gift-card / referral code brute** — no rate limit on code validation → financial impact
18- **ReDoS** — attacker-controlled input hits a catastrophic-backtracking regex → CPU exhaustion → DoS
19 
20---
21 
22## Autonomous Testing Priority
23 
24**Work within your turn budget — prioritize signal over volume.**
25…