- Joined
- Sep 16, 2026
- Messages
- 7
- Reaction score
- 1
Introduction
Imagine a vault that allows criminals to offer their procedure again and again — without law enforcement, without freezing, without consequences. Replace the vault with Instagram 2FA, GitHub accounts, OTP, and you get a lesson in failed authentication worth $25,000.
In this part of the blog, we dive deeper into the topic and look at three real-world case studies where a simple mistake, missed rate limits, could have cost these companies a lot if they had not been fixed. Treat this with a grain of skepticism as a learning experience, and let's be realistic: in 2025, it is hard to earn a bounty of thousands of dollars just for missing rate limits, since every website now applies rate limits. Keep that in mind while reading this blog.
Analysis of Specific Examples
1. Secret Disclosure: How the Lack of a Limit on the Number of Attempts Led to the Hacking of an Account Worth $5,000
Imagine a bicycle lock with a million combinations — at first glance, it is impossible to crack. But what if the lock allowed you to try all the combinations in a matter of seconds without any restrictions? In essence, that is exactly what happened when researcher MRD7 discovered the lack of rate limiting in a one-time password (OTP) system with a 6-digit code. This flaw allowed attackers to hack user accounts (turning a "secure" authentication mechanism into a one-way revolving door).
Why does this matter? OTP is the last line of security in the digital world for protecting accounts. If there were no rate limiting, even a 6-digit code could be easily brute-forced. For the target company — a mature company with dozens of resolved reports — a striking new flaw became a painful lesson: no system is completely secure.
Explanation of the Vulnerability: The Math Behind the Chaos
OTP is like perishable codes: they are designed for one-time use and lose their validity immediately after use. But here is the problem: if an attacker can try all possible combinations without hindrance, the odds are on their side. A 6-digit code has 1 million permutations (000000–999999). Although this is a huge number, modern cloud infrastructure can iterate through all these permutations in a matter of minutes.
Why does this matter:
Probability > protection: at 100 attempts per second (and using automated tools), it would take 2.7 hours to check 1 million combinations.
No noise, no surprises: without rate limiting, the target server did not record any blocked or flagged attempts.
Imagine a thief quietly trying every key on a key fob until one opens the lock — only instead he has a digital key fob, as well as a script thief.
Exploitation Process: A Silent Brute-Force Attack
MRD7's approach was methodical:
Target selection: a personal contacts app and invite-only access with OTP login.
Reconnaissance: noticed that the OTP was numeric (6 digits) and asked the question: "What is stopping me from guessing all possible codes?"
Sent repeated OTP attempts. No rate limits, no lockouts, no CAPTCHAS. Jackpot.
Automation: deployed a script to brute-force the OTP field. The work was done by cloud servers, which quickly processed thousands of combinations.
Attacker's Mindset:
Easy prey: always apply brute force to OTP fields.
Scalability: cloud tools take theoretical vulnerabilities and turn them into exploitable vulnerabilities.
Impact and Mitigation: Turning "Oops" into "Oh No"
Worst case: attackers seize any account using OTP brute force, without phishing, without malware, only with math.
How to fix it:
Rate limiting: block IP addresses/relevant accounts after 5–10 failed attempts.
Lockout: instantly block OTP attempts after several failed attempts.
Require CAPTCHA to noticeably slow down the speed of automated scripts.
Anomaly detection: notify about an increase in the number of OTP attempts.
The company fixed the flaw in 15 hours, but this case taught an important lesson: where there is process automation, there must also be protection automation.
As MRD7 showed, the smallest details — such as simply the absence of a speed bump — can nullify the greatest achievements. Be curious, test ruthlessly, and never forget: in the world of cybersecurity, complacency is what attackers want most.
2. Bypassing GitHub's Digital Protection: A $15,000 Lesson About Rate-Limiting Failures
Introduction: When "Unlimited Attempts" Become a Weapon
Imagine a vault door with a 6-digit combination lock. Now imagine that the vault allows you to spin the dial endlessly, never locking you out, no matter how many times you fail. That is exactly what researcher Tania Agarwal discovered in GitHub's OTP verification system: the lack of limits on the number of login attempts, which turns a security feature into a playground for hackers.
Why does this matter: GitHub is not just a code repository, it is a gateway to thousands of third-party services (CI/CD tools, cloud platforms, etc.). Hacking an account here can trigger a chain reaction throughout the entire digital ecosystem. For a platform trusted by millions, this oversight became a wake-up call: even giants can miss basic security measures.
Exploitation Process: How the Attacker Outsmarted the Vault
Making perfect use of design flaws, Tania carried out a brilliant attack.
The vulnerability researcher chose the OTP-based login method as the main target because of its key position in GitHub's security system.
The tester conducted reconnaissance and discovered that the system had no restrictions on the number of attempts during the manual testing phase.
The Cluster Bomb tool in Burp Suite allowed Tania to carry out simultaneous attacks on all 6 digits of the OTP.
The attack was simplified because Tania targeted each digit separately in the OTP system.
Attacker's Mindset:
Access to GitHub obtained with the help of Tesseracts is the most valuable key for professional developers.
Observing the system structure led to the question about splitting the OTP into six separate text fields. The problematic verification approach becomes noticeable when the system splits the confirmation code into multiple segments.
Burp Suite made it possible to configure the payload to make the initially difficult task with a million variants more manageable.
Impact and Mitigation: When a Single Flaw Opens All Doors
Hacking GitHub accounts allows attackers to gain access to software code and data, as well as inject malicious software into platforms interacting with AWS and npm.
Implemented fixes:
The system blocks users after five to ten failed verification attempts using OTP authentication.
OTP parameters exist as a whole concatenated string when using the parameter consolidation method (for example, otp=123456).
Monitoring: alerting on rapid OTP entry attempts.
GitHub's rapid remediation confirmed the fact that security depends more on anticipating the behavior of humans and bots than on algorithmic efforts.
Tania received $15,000 from the bug bounty program for showing us how even minor technical flaws can disrupt the most impressive security systems. You must maintain a sense of paranoia during aggressive testing and never assume that rate limits will be in place.
3. The Masked Attacker: How IP Rotation Bypassed Instagram's Two-Factor Authentication
Introduction: The Vanishing Shield
Imagine that you have a house with a security system that instantly turns off if someone enters your security code 10,000 times in front of your house while wearing 10,000 different masks. What the researcher did next is in some sense similar to what happened when a researcher abused Instagram's 2FA mechanism using IP rotation — a tool that allowed him to crack OTP codes while trying to bypass rate limits.
Significance of the term: two-factor authentication (2FA) is the last defense against account hacking. By bypassing it, attackers can block users from accessing their competitors' accounts, as well as revoke recovery options and move to Facebook-linked platforms.
Explanation of the Vulnerability: The "Chameleon" Attack
Instagram's two-factor authentication system had a serious flaw: it counted the number of failed one-time password attempts by IP address. Attackers exploited this as follows:
Changing IP addresses with each attempt (like changing costumes).
Bypassing rate limits set to prevent brute force.
Forcing Instagram to automatically remove the victim's phone number after a successful attempt.
Analogy: this is similar to a thief trying different key combinations for your lock, but changing appearance each time so that your security cameras do not recognize him as the same person.
Exploitation Process: The Proxy Dance
Here is how the attack proceeded:
1. Inspiration: the researcher took advantage of an already documented bug (the removal of Niradj Soni's phone number).
2. Reconnaissance: checked whether Instagram's OTP method blocked password-guessing attempts from a single IP address.
3. Tool setup: configured Burp Suite with:
IP rotation (via AWS API Gateway/proxy services)
A Cluster Bomb attack to brute-force 6-digit one-time passwords
4. Consequences: after successfully entering the OTP, Instagram automatically blocked the victim's phone number in her account.
Attacker's Mindset:
Relying on, by far, the prevailing research: "Obviously, my digits are deleted horizontally, a weapon of mass destruction, can I sabotage OTP systems?
Abuse of cloud infrastructure: "IP rotation is inexpensive and carried out at scale — why not?"
Timing is everything: the attack was carried out during the account registration stage, when protection was weakened.
Impact and Mitigation: When Security Backfires
Worst-case scenario: malicious hackers could potentially steal and fake the accounts of famous social media personalities for their own personal gain.
How Instagram fixed this problem:
Global limit on the number of OTP attempts (regardless of IP)
Removed automatic removal of phone numbers after OTP verification
Added confirmation before changing 2FA settings
Conclusion: A $25,000 Mistake with a Billion-Dollar Pattern
In these real-world examples, the same pattern repeats: when security teams downplayed the risks associated with brute force, attackers overestimated their creativity. What conclusions can be drawn?
Regulatory limits are non-negotiable: whether you are protecting OTP, 2FA, or an API with throughput limiting, you always act as a guard.
Context determines consequences: the GitHub vulnerability is not just a code leak, but a universal key to ecosystems.
Hackers think systemically: IP rotation + OTP flaws = 2FA removal. Always ask the question: "What is the domino effect?"
For defenders, these bounties ranging from $5,000 to $15,000 are warning signals — complacency is the cheapest way to be hacked. And for hackers? They are proof that even giants leave vault doors open.
Imagine a vault that allows criminals to offer their procedure again and again — without law enforcement, without freezing, without consequences. Replace the vault with Instagram 2FA, GitHub accounts, OTP, and you get a lesson in failed authentication worth $25,000.
In this part of the blog, we dive deeper into the topic and look at three real-world case studies where a simple mistake, missed rate limits, could have cost these companies a lot if they had not been fixed. Treat this with a grain of skepticism as a learning experience, and let's be realistic: in 2025, it is hard to earn a bounty of thousands of dollars just for missing rate limits, since every website now applies rate limits. Keep that in mind while reading this blog.
Analysis of Specific Examples
1. Secret Disclosure: How the Lack of a Limit on the Number of Attempts Led to the Hacking of an Account Worth $5,000
Imagine a bicycle lock with a million combinations — at first glance, it is impossible to crack. But what if the lock allowed you to try all the combinations in a matter of seconds without any restrictions? In essence, that is exactly what happened when researcher MRD7 discovered the lack of rate limiting in a one-time password (OTP) system with a 6-digit code. This flaw allowed attackers to hack user accounts (turning a "secure" authentication mechanism into a one-way revolving door).
Why does this matter? OTP is the last line of security in the digital world for protecting accounts. If there were no rate limiting, even a 6-digit code could be easily brute-forced. For the target company — a mature company with dozens of resolved reports — a striking new flaw became a painful lesson: no system is completely secure.
Explanation of the Vulnerability: The Math Behind the Chaos
OTP is like perishable codes: they are designed for one-time use and lose their validity immediately after use. But here is the problem: if an attacker can try all possible combinations without hindrance, the odds are on their side. A 6-digit code has 1 million permutations (000000–999999). Although this is a huge number, modern cloud infrastructure can iterate through all these permutations in a matter of minutes.
Why does this matter:
Probability > protection: at 100 attempts per second (and using automated tools), it would take 2.7 hours to check 1 million combinations.
No noise, no surprises: without rate limiting, the target server did not record any blocked or flagged attempts.
Imagine a thief quietly trying every key on a key fob until one opens the lock — only instead he has a digital key fob, as well as a script thief.
Exploitation Process: A Silent Brute-Force Attack
MRD7's approach was methodical:
Target selection: a personal contacts app and invite-only access with OTP login.
Reconnaissance: noticed that the OTP was numeric (6 digits) and asked the question: "What is stopping me from guessing all possible codes?"
Sent repeated OTP attempts. No rate limits, no lockouts, no CAPTCHAS. Jackpot.
Automation: deployed a script to brute-force the OTP field. The work was done by cloud servers, which quickly processed thousands of combinations.
Attacker's Mindset:
Easy prey: always apply brute force to OTP fields.
Scalability: cloud tools take theoretical vulnerabilities and turn them into exploitable vulnerabilities.
Impact and Mitigation: Turning "Oops" into "Oh No"
Worst case: attackers seize any account using OTP brute force, without phishing, without malware, only with math.
How to fix it:
Rate limiting: block IP addresses/relevant accounts after 5–10 failed attempts.
Lockout: instantly block OTP attempts after several failed attempts.
Require CAPTCHA to noticeably slow down the speed of automated scripts.
Anomaly detection: notify about an increase in the number of OTP attempts.
The company fixed the flaw in 15 hours, but this case taught an important lesson: where there is process automation, there must also be protection automation.
As MRD7 showed, the smallest details — such as simply the absence of a speed bump — can nullify the greatest achievements. Be curious, test ruthlessly, and never forget: in the world of cybersecurity, complacency is what attackers want most.
2. Bypassing GitHub's Digital Protection: A $15,000 Lesson About Rate-Limiting Failures
Introduction: When "Unlimited Attempts" Become a Weapon
Imagine a vault door with a 6-digit combination lock. Now imagine that the vault allows you to spin the dial endlessly, never locking you out, no matter how many times you fail. That is exactly what researcher Tania Agarwal discovered in GitHub's OTP verification system: the lack of limits on the number of login attempts, which turns a security feature into a playground for hackers.
Why does this matter: GitHub is not just a code repository, it is a gateway to thousands of third-party services (CI/CD tools, cloud platforms, etc.). Hacking an account here can trigger a chain reaction throughout the entire digital ecosystem. For a platform trusted by millions, this oversight became a wake-up call: even giants can miss basic security measures.
Exploitation Process: How the Attacker Outsmarted the Vault
Making perfect use of design flaws, Tania carried out a brilliant attack.
The vulnerability researcher chose the OTP-based login method as the main target because of its key position in GitHub's security system.
The tester conducted reconnaissance and discovered that the system had no restrictions on the number of attempts during the manual testing phase.
The Cluster Bomb tool in Burp Suite allowed Tania to carry out simultaneous attacks on all 6 digits of the OTP.
The attack was simplified because Tania targeted each digit separately in the OTP system.
Attacker's Mindset:
Access to GitHub obtained with the help of Tesseracts is the most valuable key for professional developers.
Observing the system structure led to the question about splitting the OTP into six separate text fields. The problematic verification approach becomes noticeable when the system splits the confirmation code into multiple segments.
Burp Suite made it possible to configure the payload to make the initially difficult task with a million variants more manageable.
Impact and Mitigation: When a Single Flaw Opens All Doors
Hacking GitHub accounts allows attackers to gain access to software code and data, as well as inject malicious software into platforms interacting with AWS and npm.
Implemented fixes:
The system blocks users after five to ten failed verification attempts using OTP authentication.
OTP parameters exist as a whole concatenated string when using the parameter consolidation method (for example, otp=123456).
Monitoring: alerting on rapid OTP entry attempts.
GitHub's rapid remediation confirmed the fact that security depends more on anticipating the behavior of humans and bots than on algorithmic efforts.
Tania received $15,000 from the bug bounty program for showing us how even minor technical flaws can disrupt the most impressive security systems. You must maintain a sense of paranoia during aggressive testing and never assume that rate limits will be in place.
3. The Masked Attacker: How IP Rotation Bypassed Instagram's Two-Factor Authentication
Introduction: The Vanishing Shield
Imagine that you have a house with a security system that instantly turns off if someone enters your security code 10,000 times in front of your house while wearing 10,000 different masks. What the researcher did next is in some sense similar to what happened when a researcher abused Instagram's 2FA mechanism using IP rotation — a tool that allowed him to crack OTP codes while trying to bypass rate limits.
Significance of the term: two-factor authentication (2FA) is the last defense against account hacking. By bypassing it, attackers can block users from accessing their competitors' accounts, as well as revoke recovery options and move to Facebook-linked platforms.
Explanation of the Vulnerability: The "Chameleon" Attack
Instagram's two-factor authentication system had a serious flaw: it counted the number of failed one-time password attempts by IP address. Attackers exploited this as follows:
Changing IP addresses with each attempt (like changing costumes).
Bypassing rate limits set to prevent brute force.
Forcing Instagram to automatically remove the victim's phone number after a successful attempt.
Analogy: this is similar to a thief trying different key combinations for your lock, but changing appearance each time so that your security cameras do not recognize him as the same person.
Exploitation Process: The Proxy Dance
Here is how the attack proceeded:
1. Inspiration: the researcher took advantage of an already documented bug (the removal of Niradj Soni's phone number).
2. Reconnaissance: checked whether Instagram's OTP method blocked password-guessing attempts from a single IP address.
3. Tool setup: configured Burp Suite with:
IP rotation (via AWS API Gateway/proxy services)
A Cluster Bomb attack to brute-force 6-digit one-time passwords
4. Consequences: after successfully entering the OTP, Instagram automatically blocked the victim's phone number in her account.
Attacker's Mindset:
Relying on, by far, the prevailing research: "Obviously, my digits are deleted horizontally, a weapon of mass destruction, can I sabotage OTP systems?
Abuse of cloud infrastructure: "IP rotation is inexpensive and carried out at scale — why not?"
Timing is everything: the attack was carried out during the account registration stage, when protection was weakened.
Impact and Mitigation: When Security Backfires
Worst-case scenario: malicious hackers could potentially steal and fake the accounts of famous social media personalities for their own personal gain.
How Instagram fixed this problem:
Global limit on the number of OTP attempts (regardless of IP)
Removed automatic removal of phone numbers after OTP verification
Added confirmation before changing 2FA settings
Conclusion: A $25,000 Mistake with a Billion-Dollar Pattern
In these real-world examples, the same pattern repeats: when security teams downplayed the risks associated with brute force, attackers overestimated their creativity. What conclusions can be drawn?
Regulatory limits are non-negotiable: whether you are protecting OTP, 2FA, or an API with throughput limiting, you always act as a guard.
Context determines consequences: the GitHub vulnerability is not just a code leak, but a universal key to ecosystems.
Hackers think systemically: IP rotation + OTP flaws = 2FA removal. Always ask the question: "What is the domino effect?"
For defenders, these bounties ranging from $5,000 to $15,000 are warning signals — complacency is the cheapest way to be hacked. And for hackers? They are proof that even giants leave vault doors open.
