shivendrachauhanhacker/otp-bypass-lab repository overview

⁠OTP Bypass Lab

A self-hosted, hands-on training range of 20 intentionally vulnerable OTP verification labs — one flaw per lab, each with a live login simulator, a request/response log, and a full written walkthrough (bug explanation, exploit steps, and the real-world fix).

Built for the Indian Cyber Education YouTube channel. Developed by Shivendra Chauhan.

⁠Quick Start

docker run -p 5000:5000 shivendrachauhanhacker/otp-bypass-lab

Then open http://localhost:5000⁠.

⁠Or with docker-compose

services:
  otp-lab:
    image: shivendrachauhanhacker/otp-bypass-lab
    ports:
      - "5000:5000"
    environment:
      - SECRET_KEY=change-this-secret-in-production
    restart: unless-stopped

⁠What's inside

20 labs across 8 real-world bug categories:

• Brute Force — no rate limiting
• Information Disclosure — OTP leaked in API response, OTP hidden in page source, verbose error messages
• Weak Randomness — predictable sequential codes, tiny character set, OTP derived from a user's email
• Broken Access Control — client-side-only validation, trusting a client-supplied "verified" flag, skipping verification via IDOR, Host header poisoning, spoofable rate-limit headers, trusting HTTP status over response body
• Session Management — OTP reuse, excessive expiry windows, stale token reuse
• Input Validation — empty/null OTP bypass, length-only checks
• Concurrency — race conditions on the attempt counter
• Backdoor — a leftover hardcoded master code

Each lab includes a live login simulator with a request/response log, a dedicated walkthrough page (what's wrong → how to exploit it → how to fix it), and matching Burp Suite (Proxy/Repeater/Intruder) steps.

⁠Environment Variables

⁠Disclaimer

For authorized security education and training only. Do not point any technique demonstrated here at a real, production OTP system without explicit authorization.

Developer: Shivendra Chauhan Channel: Indian Cyber Education (YouTube) Docker Hub: shivendrachauhanhacker