IntroToBurp picoCTF 2024 Solution

Description

1. Step 1Register with dummy data

   Observation

   The landing page shows a registration form before anything else. Create a throwaway account so the server issues a session and moves you to the next surface.

   Fill out the first form with any values and submit. This leads to the OTP verification page.

   Learn more

   Burp Suite is an industry-standard web application security testing platform made by PortSwigger. Its core feature is an intercepting proxy that sits between your browser and the target server, letting you read, pause, and modify every HTTP/HTTPS request and response in real time.

   When you use Burp's embedded Chromium browser, all traffic is automatically routed through the proxy without any certificate trust issues. This is the fastest way to get started, since configuring an external browser to trust Burp's self-signed CA can take extra steps.

   In real-world penetration testing, the registration step is always done first so you have a valid session to work with. Even throwaway credentials give the server enough state to present the next attack surface - in this case, the OTP form.

2. Step 2Intercept the OTP submission and mangle the field name

   Observation

   The OTP form validates in the browser before submitting. Intercept the POST in Burp and rename the otp parameter, so the server-side lookup finds nothing and skips the check.

   Turn Intercept ON in Burp's Proxy tab, enter any value in the OTP field, and submit. In the captured request body you will see otp=999 (or whatever you typed). Change the field name from otp to something like otgp so the parameter is otgp=999. The server-side code never finds the otp field, skips the check, and grants access.

   bash

   (Intercepted request body) ...&otgp=999&...

   Copied!

   What didn't work first

   Tried: Delete the otp field's value entirely, sending otp= with an empty string, instead of renaming the field.

   An empty string still counts as a present OTP, and most servers answer with 'Invalid OTP'. The bypass needs the field name itself gone, so the lookup returns null and the check never runs. Renaming it keeps the otp key out of the body entirely.

   Tried: Modify the request in the browser's DevTools Network tab using 'Edit and Resend' instead of setting up Burp.

   Firefox's Edit and Resend replays a copy of the request outside the page's flow, so the session and redirect handling the form relies on are not reproduced, and Chrome has no equivalent at all. Burp pauses the real request in flight and lets you rewrite the raw body before it reaches the server, which is what this needs.

   Learn more

   Mangling the field name is a different bypass from clearing the value. Here the server-side OTP check looks up a specific parameter name (otp). When you rename it to otgp, the lookup returns null or an empty string, and if the server code does not enforce that the field was present with a non-null value, it skips the check entirely and grants access.

   This is why proxy interception bypasses any client-side validation: the browser's JavaScript runs its checks before submission, but Burp captures the request after JS has signed off, sitting as an HTTP proxy between your browser and the server. You can mutate the body freely; the server only sees your modified request.

   This is called an OTP bypass and is a well-documented class of authentication vulnerability. Related bugs include accepting any OTP value, not expiring OTPs after use, or not rate-limiting brute-force attempts.

   • Intercept mode in Burp pauses each request so you can edit the raw body or headers before forwarding.
   • The otp= parameter appears in the POST body in application/x-www-form-urlencoded format.
   • Renaming the field tests whether the server validates that the specific named field was provided at all.
3. Step 3Forward the tampered request

   Observation

   The body already carries the renamed field, so forwarding it now reaches the server with no otp key at all.

   Forward the modified request to the server. Because the otp field name is missing, the server skips the OTP check and the response contains the flag immediately.

   Learn more

   Forwarding in Burp sends the (now modified) HTTP request to the actual server and lets you see the real response. When authentication logic is missing an empty-value check, the server returns whatever is normally shown after successful verification - in this challenge, the flag.

   This attack demonstrates why server-side validation is essential. Client-side checks (JavaScript that prevents form submission with an empty field) are trivially bypassed by any proxy tool. The server must independently verify that the OTP field is present, non-empty, and matches the expected value.

   In production systems, robust OTP implementations use time-based algorithms (TOTP, RFC 6238) and enforce server-side expiration and attempt limits, making this type of bypass impossible.

Flag

Tampering with the OTP parameter yields the flag immediately.