Challenge Overview
Try here to find the flag
Solution
Open BurpSuite and the proxy web browser with the link provided in the challenge description: http://titan.picoctf.net:49297/
For the first page, it doesn't matter the data you put in. You could put all values to anything and then click "Register". Now on the OTP page turn the "Intercept" function to on in BurpSuite.
Doesn't matter what is put for OTP. In the intercept now remove the text on line "otp=" but don't remove any spaces/lines just the text from the otp.
When forwarding this request the website gives the flag.
Flag: picoCTF{#0TP_Bypvss_SuCc3$S_3e3d...}