OTP Bypass Leads to Account Takeover on NOBroker.in Property Site.

It’s been so long since I posted any article, will continue posting some regarding my recent best findings.

What is Account Takeover Vulnerability?
It is a type of vulnerability that allows hackers to take full control of the user’s account by exploiting a flaw in the application’s logic.

Let’s dig in!

I started the journey by going through normal workflows and keeping the suspected API’s in Repeater. While Going through the Otp verification Api, I notice that the api is consuming the previously used otp for Account Login Verification.

But that’s not all there is still a journey to go.

Now I have to check if I send wrong otp multiple times then the api is blocking the Number/Limit on api in case of wrong attempt.

It’s time to send the api to the Intruder.

I have to do this carefully as my IP will be gets blocked while doing this process. So, I put the loop from 1000 to 9999. As the otp is of 4 digits and the interval of 5000 milliseconds between the next Hit. As the attack begins now i just have to wait for the Outcome. And Time comes

Conclusion

There is no limit on Otp Verification Api + Used otp is getting reused again.

Well if you love this writeup drop a clap 👏(50X), let’s connect then:

Twitter: https://twitter.com/akashkansal065

LinkedIn: https://www.linkedin.com/in/akash-kansal/

Email: akashkansal065@gmail.com

As the user is form INDIA the Medium is not paying anything for the same. So Please, Donate: https://www.paypal.me/akashkansal6896

Disclaimer

The Blog Content has been made available for informational and educational purposes only.

I hereby disclaims any and all liability to any party for any direct, indirect, implied, punitive, special, incidental or other consequential damages arising directly or indirectly from any use of the Blog Content is solely responsible by the readers.

Peace ✌️ !!!