No rate limit in otp code sending

How it was found

Summary:

There is no rate limit in sendind otp code. Thus, attacker can use this vulnerability to bomb out the mobile inbox of the victim.

Steps To Reproduce:

Step 1.

Open burp suite, and click on "Intercept is on " button from Proxy tab.

Step 2.

Launch browser and visit https://mtnonline.com/nim, and fill all the required fields, then submit.

Step 3.

Open burp suite window, and click on "HTTP history" under "Proxy" Tab, scroll on the history list and navigate on the history with https://mtnonline.com host and /nim/otp URL, and right click to "Send to Intruder".

Step 4.

Click on "Intruder" tab -> click "Position" -> click "Clear" button, and click on "Payloads", under payload type -> Select "Null payloads", In generate input, enter 10 .

Step 5.

Click on "Attack" button, and click ok on the pop-up screen.

NOTE : I only limit the sms as 10 for testing, but attacker can send unlimited sms in short time.

Supporting Material/References:

• [attachment / reference]

Impact

Attacker can bomb victim mobile inbox and cause MTN to loose the charges of sms in vein.