OTP Bypassing with Response Manipulation

Hello all pro hackers,

I’m sorry guys I didn’t bring any new blog due to some personal matter but now I will keep bringing such useful blogs for your bug-hunting journey, So let’s start the game.

If you are unfamiliar with response manipulation then I will explain it to you. When you log in or sign up on any website then it asks you for an OTP. when you enter the correct OTP then you will see 200 OK in the response and if you have entered the wrong OTP. Then it will show 403 forbidden and in some cases 400 bad requests. All these response codes are passed to us by the server.

Response manipulation can occur when a server identifies you based on the response codes it sends.

I got a private invitation so let’s assume the target is Redicated.com

Let’s Start the game

when I try to sign up on the website

the website asked me to fill out the 6-digit OTP sent to a given random number when I put random OTP like 123456

the captured request looks like

if you focus on the given body “GET /services/v2_1/ssl/users/loginOrSignup?mobileNumber=78XXXXXX63&otp=123456&cliend_id=trusted_client”

I read OWSAP's top 10 API testing bug “API2:2023 — Broken Authentication” a few days ago and I saw that if we replace v3 with v1 in the parameter then we can bypass the rate limit.

why don’t I change “v2_1” to “v1”

the modified request looks like

The real game starts from here which we call Response Manipulation

Right-click on that request than “do intercept” and click on “Response to this Request”.

When we forward this request, we can modify the response that comes after it.

Here we have the “403 forbidden” that comes inside the response which we are going to modify

I changed the “403 forbidden” to “200 OK” and removed the rest of the forbidden given below.

And when I did that the server thought that I had entered the correct OTP and it authenticated me without me entering the correct OTP.

I have logged in successfully, You can see how I bypassed OTP using response manipulation

Thanks for reading📖

Buy me a coffee to show your love 🫶

Follow for more about bug bounty and cyber security🔒