By-pass Phone Number authentication.

One day i thought of using a Wallet application to store my License and RC details instead of carrying them physically. I then downloaded the app from Playstore and registered using my mobile number and added all my details. Being a security enthusiast, I could not resist to dig deep into how the login process functions and also wanted to check if my data is safe.

"An OTP is more secure than a static password, especially a user-created password, which is typically weak" and we all agree to this but what if someone could bypass OTP authentication? That what makes it vulnerable and targeting the same , I carried out this critical piece of hunt. Let's get into the details —

While browsing through the app for vulnerabilities , I went to the "Login" functionality where it asked me to enter the registered mobile number and as I entered the number, it sent me an OTP and after filing the right OTP in the form, i was redirected to the next page. I firstly jumped into the most common and basic attack to bypass OTP — to see if there is any authentication being implemented. Let's dive into this more. When I entered the valid OTP, I got the following as the response — (Screenshot attached for reference)

VerifyOTP({

"FLAG": "Y",

})

Notice that the response parameter has "Flag — Y" which means the app is just checking for the "Flag — Y" to let the user into the application. Now to check whether it is just based on the Flag "Y", i used my friends mobile number and entered random OTP, added a breakpoint before the api gets executed, i've changed the negative response from the API and added the success response that i got previously when i used my mobile number. (Screenshot attached for reference)

Result:

I was able to successfully login into the user's account and access all his details. This is how I could bypass OTP authentication and was able to completely compromise the account details using his mobile number.

Tools:

1. Charles (To interpret the data and edit the response)

Thanks for reading!:)

Happy Hunting!