What problem does it solve? Security testers often misclassify rate-limiting defenses, reporting false negatives like "no rate limit" when an endpoint silently throttles requests, or failing to prove that an OTP keyspace is actually reachable. This Skill provides a disciplined methodology to correctly classify brute-force defenses and produce evidence-backed findings. ## Core Features & Use Cases - Four-state rate-limit classification: Distinguishes hard lockout, soft IP throttle, CAPTCHA injection, and silent shadow-throttling using status, latency, and body-size signals instead of just checking for HTTP 429. - OTP and password-reset brute-force testing: Probes 6-digit OTP keyspaces, measures throughput versus code lifetime to prove reachability, and tests IP-rotation bypasses via X-Forwarded-For and related headers. - Enumeration and token entropy analysis: Detects username/email enumeration via string, status, and timing oracles, and measures reset-token entropy with ent, Burp Sequencer, and structural analysis. - Use Case: During an authorized bug bounty engagement, you test a target's /api/verify-otp endpoint, run the shadow-throttle seed test to confirm the endpoint genuinely accepts unlimited attempts, then calculate that 50 req/s makes the 10^6 keyspace reachable in hours — a Critical ATO finding. ## Quick Start Ask the agent to test the target's login and OTP verification endpoints for missing rate limiting and username enumeration using the hunt-brute-force methodology.
