> ## Content Index
> Fetch the complete content index at: https://taiwanding.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# picoCTF IntroToBurp Writeup: Bypassing OTP with Burp Suite
- URL: https://taiwanding.com/en/picoctf-introtoburp-writeup/
- Published: 2025-08-28T16:29:15.000Z
- Updated: 2026-07-15T02:49:41.000Z
- Author: Kevin Chen
- Tags: #en, #en-ctf

## Challenge Info

- Platform: picoCTF
- Category: Web Exploitation
- Challenge link: [https://play.picoctf.org/practice/challenge/419?category=1&difficulty=1&page=1&search=IntroToBurp](https://play.picoctf.org/practice/challenge/419?category=1&difficulty=1&page=1&search=IntroToBurp&ref=taiwanding.com)

## Walkthrough

### Step 1: Recon

First I visited the site and found it was a registration system.

### Step 2: Register and Observe

- Any username/password works: username/password
- On login, I noticed there was OTP verification

### Step 3: Using Burp Suite

1. Intercept the login request
2. Inspect the request contents

### Step 4: Bypassing the OTP

- Delete the `otp` parameter
- Send the modified request

```
HTTP/1.1 200 OK
Server: Werkzeug/3.0.1 Python/3.8.10
Date: Thu, 28 Aug 2025 06:29:36 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 103
Vary: Cookie
Connection: close

Welcome, kk you sucessfully bypassed the OTP request.
Your Flag: picoCTF{#0TP_BRedacted}

```

## Key Takeaways

- Basic Burp Suite operations
- Parameter removal attacks
- Common mistakes in 2FA implementations