TL;DR

kyrux@labs

$ exploit --chain graphql-batching --target /graphql --rate-limit nginx

Root cause: GraphQL batching bypassed request-based rate limits
Barrier: 20 req/min at nginx
Bypass: pack 2000 aliases per request, split into 5 requests
Impact: brute-force OTP in minutes

Kill Chain

pipeline

01 Recon: identify /graphql + 2FA gate note
02 Barrier: nginx rate limit 20 req/min blocked
03 Technique: GraphQL batching via aliases bypass
04 Exploit: OTP brute-force inside 5 requests owned