When I was testing no rate limit attack then at that I found that there is no server side authentication of Aadhaar card number which we fill in registration form of website https://betaaccounts.digitallocker.gov.in/signup. In it we can change the valid Aadhaar number when we intercept the request of registration form