# shopper login_code's can be brute forced

Shopper login_code endpoint lacked rate limiting, letting an attacker brute-force a 5-digit SMS code and take over any shopper account by phone number.

- Payout: hidden
- Severity: high
- Program: Instacart
- Found by: b6117130df17feef13481e3
- Disclosed: 2016-09-17
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/158157
- Library page: https://bugbountylibrary.com/r/h1%3A158157
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high technique:default-creds vuln:account-takeover vuln:auth-bypass vuln:business-logic

**Target:** Shopper onboarding login_code verification endpoint (shoppers.instacart.com)
**Root cause:** The /verify_login_code endpoint enforced no attempt limit on the 5-digit login_code, so an attacker could enumerate all 100K possibilities against a known phone number.
**Steps:**
1. POST to `https://shoppers.instacart.com/send_login_code` with `utf8=%E2%9C%93&phone=(888)+999-5555` to trigger a code for the victim phone.
2. POST to `https://shoppers.instacart.com/verify_login_code` with `utf8=%E2%9C%93&phone=(888)+999-5555&login_code=3425&commit=Submit`; wrong codes return `{"error":"Sorry, but that code is incorrect."}` with HTTP 404.
3. Brute-force the 5-digit code (100K space); correct code returns `{"redirect_to":"/apply"}` with HTTP 200.
4. Log in at `https://shoppers.instacart.com/login` with the phone number and the password emailed to the attacker-controlled address.
**How found:** Noticed the verify endpoint returned distinct responses (404 error vs 200 redirect) and no lockout, then tested brute-forcing the 5-digit code space.
**Exploitation:** Attacker needs only the victim shopper's phone number: request a login_code, brute-force it via repeated POSTs to /verify_login_code, then complete login to the shopper account.
**Insight:** When a verification endpoint returns distinguishable status codes for wrong vs right codes and never rate-limits, a 5-digit SMS code is trivially enumerable; check whether the code space is small and whether attempts are throttled per phone.