When we play with JavaScript, seriously we don’t need any tool only we have to understand the flow of JavaScript. By Using JavaScript I bypassed the login in an application.
I am always excited to bypass things like login
bypass, Otp Bypass etc. while I testing an application. I always check
View-source of application mainly on login page and registration page
1. Open application login
page. There are two ways of login in the application. One way by
username and password and another one is mobile no and otp. I choose second one
2. Let’s
view source of application login page :
ON seeing this code I noticed that if otp is wrong then above function throw an error otherwise loginwithmobile(mob No) function is called.
This function checks mobile no exist or not if
mobile no exist then redirect to admin/ home/index , account is
logined otherwise it throw an error.
Now try to bypass the response and login into any
user account by putting breakpoint in JavaScript.
After implementing breakpoints, enter my no (for
testing) for login. Application asking Otp for login . Now Enter any
wrong otp (anything ) . and click on submit. Process started .On hitting submit button it hit the breakpoints , In
above screenshot , application send Post request /matchotp having
otp that we entered and waiting for response. If response is success
then loginwithmobileno function is called otherwise error thrown.
We know already that otp is wrong so
response success will never come.
I see that In response “Invalid Otp”
showing ? just simply thought I can bypass the verification by just
changing “invalid otp” to “success”. 😋
I just change Response “invalid otp” to “success”
And resume the application, Boom 😇, application login is bypassed
Comments