Hey fellow hackers and Bug hunters,

I am Ramalingasamy M K (Security Researcher).

At February 1, I booked a bus to go to my friend's home on redbus.com. After some time, I thought about how many websites there are for booking the buses. I googled something about bus booking, and I got the website. I shouldn’t disclose the website name. Let's call it target.com

On that website I saw a login, it asks for the mobile number and suddenly I thought as definitely I could be logged in using response manipulation!!. But my bad it doesn’t work.

After that, I saw an OTP sent to my mobile and it was 4-digit OTP. I try it for OTP brute force. As I thought there was no rate limiting algorithm, so I could brute-force the OTP using Turbo Intruder.

But, how should I increase the impact ?..

After one hour, I got an idea of why we searched for the contact numbers of employees who are working in target.com. After a minute of googling, I got a Senior Manager’s contact number.

I tried to contact that number and BOOM, it disclosed the email id and user id of the Manager’s contact number.

Thank you for reading this write-up.

Follow me for more bug hunting writeup’s

Follow me on Instagram : https://www.instagram.com/ram_0x_infosec/

Follow me on Twitter : https://twitter.com/Ram00733925

Connect with me on Linkedin : https://www.linkedin.com/in/ram0xinfosec/