Easy Account Takeover via OTP in Response — A Developer’s Oops Moment
Easy Account Takeover via OTP in Response — A Developer’s Oops Moment In this blog, I’ll walk you through a real-world scenario where a seemingly harmless feature—OTP-based login—unintentionally opened the door to a serious security flaw. It was like hiding the house key under the doormat: convenient, but dangerously predictable.The Setup: OTP Login Gone WrongYou enter your mobile number to log in.The app sends a request to the server.The server sends the OTP to your mobile number — so far so good.But wait — the same OTP also comes back in the HTTP response to the browser! The OTP, meant to be secret, was traveling back in plain sight, just sitting there in the network response like it’s no big deal. So, if an attacker intercepts the response (using a proxy tool like Burp Suite or browser dev tools), they can read the OTP and log in as you — without ever needing access to your phone.The Slight Twist: Encrypted OTP Now, the app I was testing did something a little better. It didn’t expose the OTP directly. Instead, it returned an encrypted OTP in the response. I started digging,I did a bit of Google dorking (searching for exposed files and endpoints).So I manually read through the Javascript files of the application. And there it was…Jackpot: Hardcoded Key & Decryption Logic in JavaScript The key and the decryption code were right there in the frontend JavaScript. Like hiding your house key under the welcome mat… and also leaving a sign that says “Key’s under here!” I copied the decryption function, plugged in the encrypted OTP, and boom — I got the original OTP. Logged in. Account taken over. No brute force, no phishing, no hacking tools — just browser dev tools and a little patience.Key Takeaways Here’s what you should remember — whether you’re a developer or a security tester:Never send OTPs (or any sensitive info) in HTTP responses, even if they’re encrypted.Never hardcode encryption keys or secrets in client-side code — it defeats the whole purpose of encryption.Always do recon. It’s not about fancy tools — sometimes, reading the JS manually is all you need.Manual inspection > automation (in many cases). Automated scanners might miss things hidden in plain sight.Final Thoughts This whole situation could’ve been avoided with just a bit more care during development. Security isn’t about paranoia — it’s about not handing over the keys to your users accounts in a gift box. If you’re a developer, always assume that anything on the frontend can be seen and manipulated by users. If you’re a bug bounty hunter, don’t underestimate the power of curiosity, recon, and reading a bit of JavaScript. https://www.linkedin.com/in/dharineesh-j/ Easy Account Takeover via OTP in Response — A Developer’s Oops Moment was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
Easy Account Takeover via OTP in Response — A Developer’s Oops Moment In this blog, I’ll walk you through a real-world scenario where a seemingly harmless feature—OTP-based login—unintentionally opened the door to a serious security flaw. It was like hiding the house key under the doormat: convenient, but dangerously predictable.The Setup: OTP Login Gone WrongYou enter your mobile number to log in.The app sends a request to the server.The server sends the OTP to your mobile number — so far so good.But wait — the same OTP also comes back in the HTTP response to the browser! The OTP, meant to be secret, was traveling back in plain sight, just sitting there in the network response like it’s no big deal. So, if an attacker intercepts the response (using a proxy tool like Burp Suite or browser dev tools), they can read the OTP and log in as you — without ever needing access to your phone.The Slight Twist: Encrypted OTP Now, the app I was testing did something a little better. It didn’t expose the OTP directly. Instead, it returned an encrypted OTP in the response. I started digging,I did a bit of Google dorking (searching for exposed files and endpoints).So I manually read through the Javascript files of the application. And there it was…Jackpot: Hardcoded Key & Decryption Logic in JavaScript The key and the decryption code were right there in the frontend JavaScript. Like hiding your house key under the welcome mat… and also leaving a sign that says “Key’s under here!” I copied the decryption function, plugged in the encrypted OTP, and boom — I got the original OTP. Logged in. Account taken over. No brute force, no phishing, no hacking tools — just browser dev tools and a little patience.Key Takeaways Here’s what you should remember — whether you’re a developer or a security tester:Never send OTPs (or any sensitive info) in HTTP responses, even if they’re encrypted.Never hardcode encryption keys or secrets in client-side code — it defeats the whole purpose of encryption.Always do recon. It’s not about fancy tools — sometimes, reading the JS manually is all you need.Manual inspection > automation (in many cases). Automated scanners might miss things hidden in plain sight.Final Thoughts This whole situation could’ve been avoided with just a bit more care during development. Security isn’t about paranoia — it’s about not handing over the keys to your users accounts in a gift box. If you’re a developer, always assume that anything on the frontend can be seen and manipulated by users. If you’re a bug bounty hunter, don’t underestimate the power of curiosity, recon, and reading a bit of JavaScript. https://www.linkedin.com/in/dharineesh-j/ Easy Account Takeover via OTP in Response — A Developer’s Oops Moment was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
Medium
Easy Account Takeover via OTP in Response — A Developer’s Oops Moment
In this blog, I’ll walk you through a real-world scenario where a seemingly harmless feature—OTP-based login—unintentionally opened the…
Template Trouble: How I Exploited a Logic Bug in a Templating Engine for RCE
Hey there!😁Continue reading on InfoSec Write-ups »
Read more...
Hey there!😁Continue reading on InfoSec Write-ups »
Read more...
Medium
🧩 Template Trouble: How I Exploited a Logic Bug in a Templating Engine for RCE 💣
Hey there!😁
How I Discovered an Open Redirect
Free Article Link: Click for free!Continue reading on InfoSec Write-ups »
Read more...
Free Article Link: Click for free!Continue reading on InfoSec Write-ups »
Read more...
Medium
How I Discovered an Open Redirect
Free Article Link: Click for free!
Mastering SQL Injection Recon: Step-by-Step Guide for Bug Bounty Hunters
A practical guide to uncovering SQL injection flaws using automation, payloads and deep reconnaissance techniques.Continue reading on InfoSec Write-ups »
Read more...
A practical guide to uncovering SQL injection flaws using automation, payloads and deep reconnaissance techniques.Continue reading on InfoSec Write-ups »
Read more...
Medium
Mastering SQL Injection Recon: Step-by-Step Guide for Bug Bounty Hunters
A practical guide to uncovering SQL injection flaws using automation, payloads and deep reconnaissance techniques.
Mastering SQL Injection Recon: Step-by-Step Guide for Bug Bounty Hunters
A practical guide to uncovering SQL injection flaws using automation, payloads and deep reconnaissance techniques.Continue reading on InfoSec Write-ups »
Read more...
A practical guide to uncovering SQL injection flaws using automation, payloads and deep reconnaissance techniques.Continue reading on InfoSec Write-ups »
Read more...
Medium
Mastering SQL Injection Recon: Step-by-Step Guide for Bug Bounty Hunters
A practical guide to uncovering SQL injection flaws using automation, payloads and deep reconnaissance techniques.
⚔️ The Brutal Truth About Bug Bounty That Nobody Tells Beginners
👉Free Article LinkContinue reading on InfoSec Write-ups »
Read more...
👉Free Article LinkContinue reading on InfoSec Write-ups »
Read more...
Medium
⚔️ The Brutal Truth About Bug Bounty That Nobody Tells Beginners
👉Free Article Link
404 to Root: How a Forgotten Subdomain Led to Server Takeover ☠️
Hey there!😁Continue reading on InfoSec Write-ups »
Read more...
Hey there!😁Continue reading on InfoSec Write-ups »
Read more...
Medium
404 to Root: How a Forgotten Subdomain Led to Server Takeover 🔍🏴☠️
Hey there!😁
Graph-QL Vulnerability can help you make $$$$
https://medium.com/@anandrishav2228/graph-ql-vulnerability-can-help-you-make-cfc79270e79d?source=rss------bug_bounty-5
https://medium.com/@anandrishav2228/graph-ql-vulnerability-can-help-you-make-cfc79270e79d?source=rss------bug_bounty-5
What is GraphQL?Continue reading on Medium » (https://medium.com/@anandrishav2228/graph-ql-vulnerability-can-help-you-make-cfc79270e79d?source=rss------bug_bounty-5)
️ How Hackers Bypass Web Application Firewalls (WAFs) in 2025
https://infosecwriteups.com/%EF%B8%8F-how-hackers-bypass-web-application-firewalls-wafs-in-2025-c2a5052044c9?source=rss------bug_bounty-5
https://infosecwriteups.com/%EF%B8%8F-how-hackers-bypass-web-application-firewalls-wafs-in-2025-c2a5052044c9?source=rss------bug_bounty-5
“Firewalls are the locks on your digital doors… but hackers are the locksmiths with infinite picks.”Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/%EF%B8%8F-how-hackers-bypass-web-application-firewalls-wafs-in-2025-c2a5052044c9?source=rss------bug_bounty-5)
Second-Order Takeover: Scoring High Rewards!
https://medium.com/@nocley/second-order-takeover-scoring-high-rewards-926ff658b76b?source=rss------bug_bounty-5
https://medium.com/@nocley/second-order-takeover-scoring-high-rewards-926ff658b76b?source=rss------bug_bounty-5
Free LinkContinue reading on Medium » (https://medium.com/@nocley/second-order-takeover-scoring-high-rewards-926ff658b76b?source=rss------bug_bounty-5)
Basic Web Enumeration.
This Write-up is all about the Basic and fast web enumeration while doing bug hunting web applications, Here, you will get to know the…Continue reading on Medium »
Read more...
This Write-up is all about the Basic and fast web enumeration while doing bug hunting web applications, Here, you will get to know the…Continue reading on Medium »
Read more...
Medium
Basic Web Enumeration.
This Write-up is all about the Basic and fast web enumeration while doing bug hunting web applications, Here, you will get to know the…
Bug Bounty Hunters in Web3: How to Start and How Much You Can Make
Security subject in Web3 is a big deal. In 2024, the Web3 ecosystem experienced a significant surge in cyberattacks, with hackers stealing…Continue reading on Medium »
Read more...
Security subject in Web3 is a big deal. In 2024, the Web3 ecosystem experienced a significant surge in cyberattacks, with hackers stealing…Continue reading on Medium »
Read more...
Medium
Bug Bounty Hunters in Web3: How to Start and How Much You Can Make
Security subject in Web3 is a big deal. In 2024, the Web3 ecosystem experienced a significant surge in cyberattacks, with hackers stealing…
The Origins of XSS (Cross-Site Scripting)
First of all, I heard you like free stuff so I made free stuff for you so you can enjoy your free stuff while you enjoy your free stuff ……Continue reading on Medium »
Read more...
First of all, I heard you like free stuff so I made free stuff for you so you can enjoy your free stuff while you enjoy your free stuff ……Continue reading on Medium »
Read more...
Medium
The Origins of XSS (Cross-Site Scripting)
First of all, I heard you like free stuff so I made free stuff for you so you can enjoy your free stuff while you enjoy your free stuff ……