picoCTF IntroToBurp Writeup: Bypassing OTP with Burp Suite

Challenge Info

• Platform: picoCTF
• Category: Web Exploitation
• Challenge link: https://play.picoctf.org/practice/challenge/419?category=1&difficulty=1&page=1&search=IntroToBurp

Walkthrough

Step 1: Recon

First I visited the site and found it was a registration system.

Step 2: Register and Observe

• Any username/password works: username/password
• On login, I noticed there was OTP verification

Step 3: Using Burp Suite

1. Intercept the login request
2. Inspect the request contents

Step 4: Bypassing the OTP

• Delete the otp parameter
• Send the modified request

HTTP/1.1 200 OK
Server: Werkzeug/3.0.1 Python/3.8.10
Date: Thu, 28 Aug 2025 06:29:36 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 103
Vary: Cookie
Connection: close

Welcome, kk you sucessfully bypassed the OTP request.
Your Flag: picoCTF{#0TP_BRedacted}

Key Takeaways

• Basic Burp Suite operations
• Parameter removal attacks
• Common mistakes in 2FA implementations