Challenge Overview
Initial Analysis
Keywords & Hints:
1. Burp Suite: The challenge emphasized the use of Burp Suite for intercepting and modifying HTTP requests.
2. Client-Side Code Modification: The clue hinted that the OTP validation was client-side, implying potential tampering opportunities.
Understanding Burp Suite:
Burp Suite is an integrated platform for security testing of web applications. Its tools enable you to:
- Intercept and analyze HTTP/S traffic.
- Map attack surfaces and find vulnerabilities.
Prerequisites:
1. Burp Suite Installed: Required for intercepting and modifying HTTP requests.
2. Basic Knowledge of Protocols: Familiarity with HTTP requests and responses helps understand the challenge setup.
Solution Approach
Step 1: Setting Up Burp Suite
1. Open Burp Suite, where you’ll find various tools on the dashboard.
2. For this challenge, you’ll mainly use the Proxy tool. Ensure the Intercept option is OFF initially.
3. Click on Open Browser. This will open a PortSwigger browser window.
4. Paste the provided challenge link (login page URL) into the browser.
Step 2: Simulating a Registration/Login
1. The registration page will open. Enter random information as the registration details don’t affect flag identification.
2. Click Enter, which takes you to an Enter OTP page.
Step 3: Testing the OTP Input
1. Input a random value in the OTP field (e.g., `123`). The server will respond with an “invalid OTP” message.
2. Switch back to Burp Suite.
Step 4: Capturing the Request
1. In Burp Suite, turn ON the Interceptor in the Proxy tab.
2. You will now see intercepted traffic in Burp Suite with different columns such as Request, Response, etc.
3. Identify the intercepted POST request to the dashboard endpoint with a parameter like `otp=123`.
Step 5: Modifying the Request
a. Select the intercepted request and use the ‘ Send to Repeater’ option from the dropdown menu.
b. Navigate to the Repeater tab on the dashboard.
c. In the Request section, remove the `otp` parameter entirely.
d. Send the modified request using the Send button.
Step 6: Viewing the Response
a. The server responds with a success message indicating that you’ve bypassed the OTP check.
b. The response includes the flag:
The flag is picoCTF{#0TP_Bypvss_SuCc3$S_b3fa4f1a}
