Bypass 2FA Using Status Code Manipulation

Muhammad Daffa
1 min readFeb 16, 2021

--

Hello, my name is Muhammad Daffa, in this post I want to share about a vulnerability that I found on a private program

First, when I’m login to the website, it requires an OTP code to go to the dashboard, in this case, I’m using random OTP code to test the website. The request will look like this:

POST /api/2fa/verify-code/ HTTP/1.1
Host: site.com
[...]
{"code":"12345","remember_me":false}

And the response looks like this

HTTP/1.1 404 Not Found
[...]
{"status":"Wrong code"}

But if I am inputting the right OTP code, the response will look like this

HTTP/1.1 200 OK
[...]
{"id":"111111111-aaaa-dddd-fffff-xxxxxxxxxx","code":"123456"}

And then I’m thinking, how about I change the response code in the response? So when I intercept the request, I am intercepting the response too. So, from 404 Not Found, I change the status code to 200 OK. The response will look like this

HTTP/1.1 200 OK
[...]
{"status":"Wrong code"}

And suddenly I logged in to my account without using the right OTP code. Quickly I reported it to the company and I was rewarded with $$$

That’s it for this writeup from me, I hope you guys enjoying it.

  • December 2020 -> Triaged
  • February 2021 -> Rewarded

--

--

Muhammad Daffa

ID/EN. Write anything related to cyber security (Bug Bounty, Penenetration Testing, Malware Analysis, etc.)