IntroToBurp — picoCTF Writeup

Challenge Description

The IntroToBurp challenge is a web exploitation challenge from picoCTF 2024.

The challenge provides a registration form followed by a 2FA OTP verification page. The goal is to use Burp Suite to intercept and modify the HTTP request to bypass the OTP check and retrieve the flag.

Difficulty: Medium

Core Concepts (Quick)

Burp Suite

Burp Suite acts as a proxy between the browser and the web server, allowing us to inspect and modify HTTP requests.

HTTP Request Interception

Burp's Proxy → Intercept feature lets us stop a request before it reaches the server and modify its parameters.

Parameter Tampering

Changing or removing parameters from an HTTP request can sometimes bypass poorly implemented server-side validation.

Step-by-Step Exploitation

Step 1 — Open the Challenge Website

Open the challenge instance provided by picoCTF.

The first page contains a registration form.

Fill in the required fields with any values and click:

Register

Register

The application accepts the registration and redirects us to a 2FA authentication page.

Step 2 — Reach the OTP Page

The next page asks for an OTP (One-Time Password).

Enter any value into the OTP field and submit it.

The application responds with an invalid OTP message.

This tells us that simply guessing the OTP is not the intended solution.

Step 3 — Intercept the Request with Burp Suite

Open Burp Suite and configure the browser to use Burp's proxy.

Then enable:

Proxy → Intercept → Intercept is ON

Proxy → Intercept → Intercept is ON

Submit another OTP from the browser.

Burp now intercepts the HTTP request before it reaches the server.

The request contains an OTP parameter similar to:

otp=123456

otp=123456

Step 4 — Modify the OTP Parameter

Instead of trying to guess the correct OTP, modify the intercepted request.

Remove the value after the otp= parameter:

otp=

otp=

The important part is that we are not providing an OTP value.

Forward the modified request to the server.

The application fails to properly validate the missing OTP parameter and processes the request as if the OTP requirement was bypassed.

Step 5 — Capture the Response

After forwarding the modified request, the server responds with a successful bypass message containing the flag.

🎉 FLAG CAPTURED

Why This Works

The vulnerability is caused by improper server-side validation.

The application expects the user to provide an OTP, but the server does not correctly reject a request when the OTP parameter is missing or malformed.

By intercepting the request and changing:

otp=123456

otp=123456

to:

otp=

otp=

we can bypass the OTP verification.

This is an example of parameter tampering, where an attacker modifies data sent to the server to change the application's behavior.

Attack Summary

1. Open the challenge website.
2. Register with arbitrary details.
3. Reach the 2FA OTP page.
4. Enter any OTP.
5. Intercept the request using Burp Suite.
6. Locate the otp parameter.
7. Remove the OTP value.
8. Forward the modified request.
9. Retrieve the flag from the response.

Key Learnings

• Burp Suite is useful for intercepting and modifying HTTP requests.
• Never assume that client-side validation is enough.
• Every required parameter must be validated server-side.
• Missing or malformed parameters can sometimes expose authentication bypasses.
• Parameter tampering is a useful technique to test whenever an application relies on user-controlled request data.

Final Flag

picoCTF{#0TP_Bypvss_SuCc3$S_6bffad21}

picoCTF{#0TP_Bypvss_SuCc3$S_6bffad21}

Conclusion

The IntroToBurp challenge demonstrates how a simple request modification can bypass a poorly implemented OTP mechanism.

Instead of trying to crack or guess the OTP, we intercepted the HTTP request with Burp Suite and removed the OTP value. Because the server failed to properly validate the missing parameter, the OTP verification was bypassed and the flag was returned.

📬 Stay Connected

If you found this helpful and want to learn more about web security, hands-on labs, feel free to follow me for upcoming posts.

✍️ Follow me for more cybersecurity write-ups 🔗 LinkedIn — codermayank 📸 Instagram — @mayhack_

Tags: #BugBounty #EthicalHacking #ChatGPT #CyberSecurity #AIforSecurity #PenetrationTesting #HackerOne #Bugcrowd #WebSecurity #InfoSec