Hunt Brute Force
Hunt Missing/Weak Rate Limiting, login brute force, OTP/2FA brute force (10^6...
Install
npx skills add elementalsouls/Claude-BugHunter --skill hunt-brute-force -g -a claude-code -y- Repository
- elementalsouls/Claude-BugHunter5.4k
- Category
- Engineering
- Updated
- 3d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Hunt Missing/Weak Rate Limiting, login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enumeration via error-string / status-code / timing differences, weak password policy, missing CAPTCHA (CAPTCHA token replay / single-use / concurrency-window bypass specifics → hunt-captcha-bypass), IP-based rate-limit bypass via X-Forwarded-For and friends, ReDoS. Distinguishes hard lockout vs soft IP-throttle vs CAPTCHA-injection vs silent shadow-throttling (avoids false-negative 'no rate limit' conclusions). Medium to Critical depending on what the brute reaches (OTP→ATO = Critical).
HUNT-BRUTE-FORCE, Rate Limiting / Brute Force / Enumeration
Grounding note: this skill is built from published technique classes, not from a curated set of named HackerOne reports.
report_countis intentionally0, do not cite an exact payout or report ID you cannot verify. Where a public case is well-documented (e.g. Laxman Muthiyah's Instagram password-reset OTP race/rotation research, 2019, 2021), it is named below as a technique reference, not a payout claim.
Crown Jewel Targets
OTP brute force (6-digit = 1,000,000 combinations) with no effective rate limit = Critical ATO bypass.
Highest-value chains:
- OTP / 2FA brute → MFA bypass → ATO, no effective rate limit on
/verify-otp, full 000000, 999999 keyspace reachable - Password-reset token brute, short/predictable/non-expiring tokens + no rate limit → ATO (the Instagram 2019 case combined a 6-digit reset code, no rate limit per request-source, and IP rotation to make 10^6 tractable)
- Username/email enumeration → targeted credential stuffing, valid/invalid distinguishable by response string, status code, or timing, then sprayed with breach corpora
- Coupon / gift-card / referral code brute, no rate limit on code validation → financial impact
- ReDoS, attacker-controlled input hits a catastrophic-backtracking regex → CPU exhaustion → DoS
Autonomous Testing Priority
Work within your turn budget, prioritize signal over volume.
You cannot brute-force millions of combinations in automated testing. Focus on two things: (1) credential spraying with the most likely candidates, and (2) detecting whether rate limiting exists at all.
