Authentication OTP bypass AND Information Disclosure (SSRF) || bug bounty poc 2023 || site hack

Hello friends
Today I want to work on a target that easily bypasses the site's authentication system and then tests an SSRF vulnerability.

[@sw4pn3h0x8]

But you opened the link in your browser so the http request recieved is of your own not the server’s

[@entertainment6655]

The SSRF was next level. 😂

[@gouthamas532]

Verification bypass is fine, but it's not a SSRF

[@huzifaahmed1426]

OTP is serious finding but in the ssrf the calling came from your own network not the server IP. the important think in ssrf is the calling and its hould came from the original website server

[@bkg2190]

Awesome 👍

[@user-tf3gr2sd6x]

After watching this POC i am able to do SSRF on every website.

[@Avoshsecurity]

You're welcome

[@gouthamas532]

If you follow this step for ssrf, you won't get any bounty for sure 😂 because it's not a valid way of finding ssrf

[@Cyber_Sec_]

Nice

[@vimalvinz9843]

Great finding 👌😏

[@IllIIIIIIllll]

Wow didn't knew slack would have that OTP verify😂.

[@Avoshsecurity]

You're welcome

[@INFINITY-GAMER7345]

is that you reported

[@montala3380]

It is not vulnerable at SSRF =)) When you remove `tel` and your browser call to the Burp-collab → the IP got recorded is yours not from the Slack. For the second SSRF it could be because I saw 2 different IP as well as DNS. 1 is belonging to you, and the rest could be from Slack

[@yashraj3979]

Ssrf 😂