Remove or nullify captcha parameters to bypass captcha requirements. Fallback methods might expose vulnerabilities.
Rotate your IP using services like Brightproxy or Burp Suite IP rotate extension. A different IP can sometimes slip through restrictions.
Trick the server by appending %0d before the username. Experiment with multiple %0d if needed; it might confuse the server's parsing.
Search for alternative login or forgot password endpoints; they might be hidden in mobile apps or legacy JS files.
Bonus trick (My Secret trick): Rate limiting rules are often based on specific endpoint routes. By modifying the route with /. or /.. the request may no longer match the rate-limiting criteria, allowing for additional requests. Use /. in route modification to confuse the server's normalization, possibly bypassing rate limits. When /. or /.. is appended, the server might remove it during normalization, effectively treating /path and /path/.. as the same request. This can lead to bypassing rate limits. Please leave a comment if you would like to read a write-up about how I bypass rate limit with this secret trick and earn bounties. I've successfully bypassed over 20+ restrictions, and get collectively thousands of dollars in bounties by this simple bug. Stay tuned for more exclusive tricks and techniques!