How to stop preventing OTP Bypass through Response Manipulation

This blog post explains how to effectively prevent OTP (One-Time Password) bypass attacks, focusing on Node.js and React.js, but applicable to other technologies. It details techniques and best practices to secure your OTP implementation.

Understanding OTP Bypass Attacks

OTP bypass exploits application vulnerabilities to gain unauthorized access without a valid OTP. Attackers might use invalid or expired OTPs, or manipulate API responses (often using tools like Burp Suite) to circumvent OTP verification. A common attack involves intercepting a valid response from a legitimate user and reusing it for unauthorized access.

Preventing Response Manipulation

Simply encrypting API responses isn't sufficient. While encryption (using AES or RSA) protects data in transit, identical responses for all users create a vulnerability. Even with encryption, if the success/failure criteria are based solely on the HTTP status code or a consistent success message ("OTP verified successfully"), an attacker can still bypass OTP verification by replaying a captured successful response.

A Robust Solution: Unique Response IDs

The solution involves generating a unique, per-user identifier for each request. This prevents response replay attacks. The method outlined avoids database use:

Client-Side Implementation (React.js example):

1. Encrypt Payload: Encrypt the OTP data before sending it to the server.
2. Generate Unique ID: Create a unique 7-character ID (UID, rsid). You can use any suitable random ID generation method.
3. Send UID in Header: Include the rsid in the request header.
4. API Call: Send the encrypted data and rsid to the server.
5. Response Validation: Decrypt the server's response.
6. UID Matching: Crucially, compare the rsid received in the response with the one sent in the request header. A match indicates successful verification; a mismatch signifies an attack attempt.

<code class="language-javascript">const OnSubmit = async () => {
  let data = await AesEncrypt(form);
  let verifyobj = { "encdata": data };
  let getid = await makeid(7);
  let config = { headers: { "rsid": getid } };
  let ApiCallverify = await axios.post("http://localhost:4000/api/verifyotp", verifyobj, config);
  let decryptedData = await Aesdecrypt(ApiCallverify.data.dataenc);
  if (ApiCallverify && ApiCallverify.data.dataenc && ApiCallverify.status === 200) {
    if (decryptedData.rsid === getid) {
      alert(decryptedData.message);
    } else {
      alert("Invalid User");
    }
  } else {
    alert(decryptedData.message);
  }
};</code>

Server-Side Implementation (Node.js example):

1. Request Validation: Verify the request body (encrypted data) and the presence of the rsid header.
2. Decryption: Decrypt the request body.
3. OTP Validation: Validate the OTP against the user's information (using a database or other secure storage).
4. Response Generation: If validation succeeds, encrypt the response and include the original rsid from the request header.
5. Response Sending: Send the encrypted response.

<code class="language-javascript">const OnSubmit = async () => {
  let data = await AesEncrypt(form);
  let verifyobj = { "encdata": data };
  let getid = await makeid(7);
  let config = { headers: { "rsid": getid } };
  let ApiCallverify = await axios.post("http://localhost:4000/api/verifyotp", verifyobj, config);
  let decryptedData = await Aesdecrypt(ApiCallverify.data.dataenc);
  if (ApiCallverify && ApiCallverify.data.dataenc && ApiCallverify.status === 200) {
    if (decryptedData.rsid === getid) {
      alert(decryptedData.message);
    } else {
      alert("Invalid User");
    }
  } else {
    alert(decryptedData.message);
  }
};</code>

Demonstrated Effectiveness: The blog post includes screenshots showing successful logins and failed attempts using Burp Suite to intercept and modify responses. The unique rsid prevents successful replay attacks.

The images remain in their original positions. Note that the image URLs are preserved. To display them correctly, a system needs to be able to access those URLs.

The above is the detailed content of How to stop preventing OTP Bypass through Response Manipulation. For more information, please follow other related articles on the PHP Chinese website!