Bypassing OTP Verification: Another Bug Found Without Any Tools!

Welcome Back to My Bug Hunting Series! 🚀

The more I test manually, the more I realize that finding bugs doesn’t always require fancy tools. Sometimes, all it takes is a careful look at how things work.

If you’re new to bug hunting or just curious about how these things work, this post will show you that even simple mistakes can lead to big vulnerabilities. Let’s get into the details!

This is the second bug in my series on finding bugs without using any tools. This time, I accidentally discovered an OTP bypass — but hey, that doesn’t matter! What really matters is… I got a bounty for it! 💰🎉

Let’s Talk About Website Functionality

This website works just like any other site that requires OTP verification for signup to confirm your email. This one does too — but with a twist. I noticed that OTP is only used during registration, while the “Forgot Password” feature sends a reset link instead.

If the website also used an OTP for password resets, this bug would be way more critical. But even as it is, it’s still a pretty serious issue! 🚨

The Bug 🐞: Steps to Reproduce

1. Go to the Sign-Up Page:
   Visit the registration page at 👉 hxxps://website.com/signup/.
2. Enter Your Details:
   Fill in the form with your email (e.g., myemail@gmail.com) and click the Sign Up button.
3. OTP Verification Page Appears:
   A code will be sent to your email. Do not use this code! Instead, press the Back button.
4. Re-enter Details with Victim’s Email:
   Go back to the Sign-Up page and fill in the form again, but this time use the victim’s email (e.g., victim@gmail.com).
5. Click Sign Up Again:
   When prompted for the OTP, enter the code sent to your email (myemail@gmail.com).
6. Account Created Successfully:
   The website accepts the code, and the account is successfully created using the victim’s email (victim@gmail.com).

How the Bug Works

The issue lies in how the website verifies email addresses. Instead of tying the OTP to the specific email entered during registration, the system accepts any valid OTP — even one from a different email! This misconfiguration makes it possible to bypass email verification.

Final Thoughts

This was another bug I found without using any tools — just careful manual testing! Finding security flaws doesn’t always require fancy software; sometimes, simply observing how a system behaves can reveal critical vulnerabilities.

And the best part? I got a bounty for this! 💰🎉

Stay tuned for more bug-hunting stories in this series! 🚀

THANK YOU 😊