[Day 4] 2. Bypassing OTP Verification

Steps to Bypass OTP:

1. Turn off Burp Suite Interceptor and open your browser.
2. Search for "Xplore" on Google (or any site with an OTP vulnerability).
3. Click the "Register" button to begin the OTP verification process.
4. Turn on the Burp Suite Interceptor after clicking the register button.
5. Enter your phone number and click "Send OTP".
   • At this stage, the OTP request might not show in Burp Suite, meaning the verification is happening on the page itself.
6. Inspect the page by right-clicking and selecting "Inspect".
7. Search for the "Verify" button's code in the page’s source code.
   • You can find the OTP from this code.

Explanation

• In this method, we bypass the OTP check because of vulnerabilities in the source code written by developers.
• The OTP process is supposed to be handled on the server side, but here, it’s being handled on the client-side (in the page’s code), making it easier for attackers to retrieve or bypass the OTP.