IntroToBurp — picoCTF Write-up | Bypassing OTP Validation with Burp Suite

Introduction

While practicing web exploitation challenges on picoCTF / CyLab Academy, I solved a beginner-friendly challenge called IntroToBurp.

As the name suggests, this challenge introduces Burp Suite and shows why inspecting and modifying HTTP requests is an important skill in web security.

The challenge starts with a registration form and later asks for an OTP. The interesting part is understanding how the server handles that OTP request.

Challenge: IntroToBurp Category: Web Exploitation Platform: picoCTF / CyLab Academy Main Concept: Burp Suite, HTTP Request Manipulation, OTP Validation

Starting with Registration

After launching the challenge, I found a simple registration page asking for:

I filled in the required information and clicked Register.

After registration, the application redirected me to a 2FA authentication page.

The OTP Page

The next page asked me to enter an OTP.

I didn't know the correct OTP, so instead of trying to guess it repeatedly, I decided to inspect how the application was sending the OTP to the server.

This was the perfect place to use Burp Suite.

Intercepting the Request with Burp Suite

I configured the browser to send traffic through Burp Suite and submitted a test OTP.

Burp captured a request containing:

This confirmed that the server was checking the otp parameter.

Now I became curious about one thing:

What happens if the OTP parameter isn't sent at all?

Modifying the Request

Using Burp Suite, I modified the intercepted request and removed the OTP parameter from the request body.

Instead of sending:

otp=1234

the request was sent without the OTP value.

This is an important part of web application testing. We should not only test different values but also check how the server behaves when expected parameters are missing, empty, duplicated, or modified.

OTP Validation Bypassed

After sending the modified request without the OTP parameter, the server responded differently.

The response said:

And with that, the challenge was solved! 🚩

Understanding the Vulnerability

The issue was caused by improper server-side OTP validation.

The application correctly rejected an invalid OTP:

Invalid OTP → Access Denied

But when the OTP parameter was removed entirely, the application failed to handle that condition securely:

Missing OTP → Authentication Bypass

The complete flow was:

Registration → 2FA Page → Intercept Request → Test Invalid OTP → Remove OTP Parameter → Send Modified Request → OTP Bypass → Flag 🚩

A secure application should reject the request whenever the OTP is incorrect, empty, or missing.

What I Learned

This challenge helped me understand:

• How to intercept requests using Burp Suite.
• How HTTP POST parameters work.
• How to modify requests using Burp.
• Why testing missing parameters is important.
• How weak server-side validation can cause authentication bypass.
• Why security controls cannot rely only on frontend behavior.

Most importantly, IntroToBurp showed why understanding the actual HTTP request is often more useful than looking only at what appears in the browser.

Conclusion

IntroToBurp was a simple and useful introduction to request manipulation with Burp Suite.

After registering, I reached the OTP verification page. A random OTP returned Invalid OTP, but after intercepting the request and removing the OTP parameter, the server incorrectly allowed the request and returned the flag.

The main takeaway is:

Always validate security-critical parameters on the server, including cases where the parameter is completely missing.

Connect With Me

LinkedIn: https://www.linkedin.com/in/affanhaxor Instagram: https://instagram.com/affan_haxor

Follow me for more CTF write-ups, web security labs, and AppSec content.