How to Bypass 2FA with an HTTP Header

Summary: 2FA token was only some digits, so can be brute forced. But they implemented rate limiting, based on IP. Unfortunately the application accepted the X-Forwarded-For header as if it were the real IP and by randomizing that header, you can do as many requests as you want.

Misleading title, a better title would be: How I bypassed 2FA Rate-limits with an HTTP Header.