Tutorial HOW TO BYPASS OTP ON ALMOST ANY SITE! 🔥[Educational purpose]

fsociety · 09-23-2020, 04:23 PM

Code:
This method is used by many pentester to exploit the vulnerabilities of a website with OTP functionality. Also, nowadays, unacademy's OTP vulnerability is exposed. 

This mainly requires a tool burp suite available for free, which can help you change the response of the OTP verification from the client-side. 
We have also attached a page where these vulnerabilities are explained very precisely.

⭐️ EDUCATIONAL PURPOSE ONLY ⭐️

ENJOY 👍❤️

LINK : https://anonfiles.com/p5cch9Nbo0/video_2...-21-15_mp4

Join us on telegram for more content like this : https://t.me/hack11003

DropShein · 10-08-2020, 02:34 PM

(09-23-2020, 04:23 PM)fsociety Wrote:
Code:
This method is used by many pentester to exploit the vulnerabilities of a website with OTP functionality. Also, nowadays, unacademy's OTP vulnerability is exposed. This mainly requires a tool burp suite available for free, which can help you change the response of the OTP verification from the client-side. We have also attached a page where these vulnerabilities are explained very precisely.

⭐️ EDUCATIONAL PURPOSE ONLY ⭐️

ENJOY 👍❤️

LINK : https://anonfiles.com/p5cch9Nbo0/video_2...-21-15_mp4

Join us on telegram for more content like this : https://t.me/hack11003

Is possible to bypass 2fa auth with this method?

btw, would you mind sharing the tool name? i mean, the one used for capturing the request.

fritz · 10-08-2020, 04:55 PM

(10-08-2020, 02:34 PM)DropShein Wrote:
(09-23-2020, 04:23 PM)fsociety Wrote:
Code:
This method is used by many pentester to exploit the vulnerabilities of a website with OTP functionality. Also, nowadays, unacademy's OTP vulnerability is exposed. This mainly requires a tool burp suite available for free, which can help you change the response of the OTP verification from the client-side. We have also attached a page where these vulnerabilities are explained very precisely.

⭐️ EDUCATIONAL PURPOSE ONLY ⭐️

ENJOY 👍❤️

LINK : https://anonfiles.com/p5cch9Nbo0/video_2...-21-15_mp4

Join us on telegram for more content like this : https://t.me/hack11003

Is possible to bypass 2fa auth with this method?

btw, would you mind sharing the tool name? i mean, the one used for capturing the request.

From what I'm seeing you could use pretty much any web developer tool included in classic web browsers.
Theoretically you could bypass 2fa if they have the same exploit (sharing the OTP session code in error response, if I understand correctly), but it's probably a bad implementation originally.

fritz · 10-08-2020, 08:17 PM

(10-08-2020, 02:34 PM)DropShein Wrote:
(09-23-2020, 04:23 PM)fsociety Wrote:
Code:
This method is used by many pentester to exploit the vulnerabilities of a website with OTP functionality. Also, nowadays, unacademy's OTP vulnerability is exposed. This mainly requires a tool burp suite available for free, which can help you change the response of the OTP verification from the client-side. We have also attached a page where these vulnerabilities are explained very precisely.

⭐️ EDUCATIONAL PURPOSE ONLY ⭐️

ENJOY 👍❤️

LINK : https://anonfiles.com/p5cch9Nbo0/video_2...-21-15_mp4

Join us on telegram for more content like this : https://t.me/hack11003

Is possible to bypass 2fa auth with this method?

btw, would you mind sharing the tool name? i mean, the one used for capturing the request.

I just had a look at mail.ru OTP for example, and I can confirm this technique wouldn't work. Here is the error message :

Code:
{
	"body": {
		"reg_token.value": {
			"value": "122532",
			"error": "invalid"
		}
	},
	"email": "xxxx@mail.ru",
	"status": 400,
	"htmlencoded": false
}

No OTP session code whatsoever.
Wonder if there is any other working example Wink

lukedoe432 · 12-10-2020, 07:56 PM

Very rarely use of this trick almost all OTP are not generated with thissupported exploit...thanks for sharing

Trilly Reign · 12-10-2020, 09:31 PM

(10-08-2020, 04:55 PM)fritz Wrote:
(10-08-2020, 02:34 PM)DropShein Wrote:
(09-23-2020, 04:23 PM)fsociety Wrote:
Code:
This method is used by many pentester to exploit the vulnerabilities of a website with OTP functionality. Also, nowadays, unacademy's OTP vulnerability is exposed. This mainly requires a tool burp suite available for free, which can help you change the response of the OTP verification from the client-side. We have also attached a page where these vulnerabilities are explained very precisely.

⭐️ EDUCATIONAL PURPOSE ONLY ⭐️

ENJOY 👍❤️

LINK : https://anonfiles.com/p5cch9Nbo0/video_2...-21-15_mp4

Join us on telegram for more content like this : https://t.me/hack11003

Is possible to bypass 2fa auth with this method?

btw, would you mind sharing the tool name? i mean, the one used for capturing the request.

From what I'm seeing you could use pretty much any web developer tool included in classic web browsers.
Theoretically you could bypass 2fa if they have the same exploit (sharing the OTP session code in error response, if I understand correctly), but it's probably a bad implementation originally.

I was about to say the same thing. 😂