>Home>Labs>New labs>Creators>Ranking>Learn>Business>Pricing
ES
Sign inCreate account
Home·Academy·Topics·bypass
Topic · 3 articles

bypass

Intermediate level

2
With account

2FA bypass — TOTP brute force, response manipulation, fallback abuse, race conditions

Real 2FA bypass techniques: TOTP brute force, response manipulation (status 200 with no valid token), fallback to email OTP, race conditions in setup.

14 min2faauthtotp
Read article
Free

Rate limit bypasses — IP rotation, header spoofing, casing and alternative endpoints

X-Forwarded-For, IP rotation with cloudfront IPs, path casing, encoding tricks, bucket race condition. How to find the gaps in throttling.

10 minrate-limitingbypassbrute-force
Read article

Advanced level

1
Free

SSRF — complete bypasses: localhost, IPv6, decimal, DNS and cloud metadata

11 techniques to bypass SSRF validation: enclosed alphanumeric, decimal IP, dot bypass, DNS rebinding, parameter pollution. Cloud metadata AWS/GCP/Azure.

14 minssrfbypasscloud-metadata
Read article

Practice bypass with real labs

Apply the techniques in safe environments based on real bug bounty reports.

See bypass labs
All topicsAcademy
hunters training
711

hunters training

labs from real reports
55

labs from real reports

completions
1,205

completions

in bounties practiced
$213,970

in bounties practiced

46 flags captured this week·Real reports from HackerOne · Bugcrowd · Intigriti·No commitment·Free Academy
BBLabs · bug bounty training

Stop reading about bugs and start hunting them

Create your free account and practice on labs based on real reports that paid out thousands of euros. The Academy is free forever.

Create free accountSee the labs

No card · free Academy · cancel anytime