hunt-brute-force

# HUNT-BRUTE-FORCE — Rate Limiting / Brute Force / Enumeration > Grounding note: this skill is built from published technique classes, not from a > curated set of named HackerOne reports. `report_count` is intentionally `0` — do > not cite an exact payout or report ID you cannot verify. Where a public case is > well-documented (e.g. Laxman Muthiyah's Instagram password-reset OTP race/rotation > research, 2019–2021), it is named below as a *technique reference*, not a payout claim. ## Crown Jewel Targets OTP brute force (6-digit = 1,000,000 combinations) with no effective rate limit = Critical ATO bypass. **Highest-value chains:** - **OTP / 2FA brute → MFA bypass → ATO** — no effective rate limit on `/verify-otp`, full 000000–999999 keyspace reachable - **Password-reset token brute** — short/predictable/non-expiring tokens + no rate limit → ATO (the Instagram 2019 case combined a 6-digit reset code, no rate limit per request-source, and IP rotation to make 10^6 tractable) - **Username/email enumeration → targeted credential stuffing** — valid/invalid distinguishable by response string, status code, or timing, then sprayed with breach corpora - **Coupon / gift-card / referral code brute** — no rate limit on code validation → financial impact - **ReDoS** — attacker-controlled input hits a catastrophic-backtracking regex → CPU exhaustion → DoS --- ## Autonomous Testing Priority **Work within your turn budget — prioritize signal over volume.** You cannot brute-force millio...