Cybersecurity
Hunt Brute Force
Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enumeration via error-string / status-code / timing differences, weak password policy, missing CAPTCHA (CAPTCHA token replay / single-use / concurrency-window bypass specifics → hunt-captcha-bypass), IP-based rate-limit bypass via X-Forwarded-For and friends, ReDoS. Distinguishes hard lockout vs soft IP-throttle vs CAPTCHA-injection vs silent shadow-throttling (avoids false-negative 'no rate limit' conclusions). Medium to Critical depending on what the brute reaches (OTP→ATO = Critical).
- Publisher / source
- elementalsouls/Claude-BugHunter (found on GitHub top repositories)
- Upstream record
- elementalsouls/Claude-BugHunter
- Version
- Version 1
- Published
- Publication review
- Approved for publication
- Content fingerprint
cca90153a3154dc7b188addb2ec3da804cea91f0d619fb9e17e289dcd3c4b1ce