> ## Content Index
> Fetch the complete content index at: https://taiwanding.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# picoCTF - IntroToBurp writeup (zh-TW)
- URL: https://taiwanding.com/picoctf-introtoburp-writeup-zh-tw/
- Published: 2025-08-28T16:29:15.000Z
- Updated: 2026-07-15T02:49:42.000Z
- Author: Kevin Chen
- Tags: CTF, #picoCTF

## 題目資訊

- 平台：picoCTF
- 分類：Web Exploitation
- 題目連結：[https://play.picoctf.org/practice/challenge/419?category=1&difficulty=1&page=1&search=IntroToBurp](https://play.picoctf.org/practice/challenge/419?category=1&difficulty=1&page=1&search=IntroToBurp&ref=taiwanding.com)

## 解題過程

### Step 1: 偵察

先訪問網站，發現是一個註冊系統

### Step 2: 註冊與觀察

- 任意帳號密碼：username/password
- 登入時發現有 OTP 驗證

### Step 3: 使用 Burp Suite

1. 攔截登入請求
2. 觀察請求內容

### Step 4: 繞過 OTP

- 刪除 `otp` 參數
- 送出修改後的請求

```
HTTP/1.1 200 OK
Server: Werkzeug/3.0.1 Python/3.8.10
Date: Thu, 28 Aug 2025 06:29:36 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 103
Vary: Cookie
Connection: close

Welcome, kk you sucessfully bypassed the OTP request. 
Your Flag: picoCTF{#0TP_BRedacted}

```

## 學習重點

- Burp Suite 基本操作
- 參數移除攻擊
- 2FA 實作的常見錯誤