# Authorization bypass using login by phone option+horizontal escalation possible on Grab Android App

Grab's SMS OTP activation endpoint lacked rate limiting on resend, letting an attacker brute-force a 4-digit code across unlimited 30-second windows to take over any account by phone number.

- Payout: hidden
- Severity: high
- Program: Grab
- Found by: sp1d3rs
- Disclosed: 2017-09-14
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/205000
- Library page: https://bugbountylibrary.com/r/h1%3A205000
- Tags: area:mobile domain:api domain:mobile impact:ato kind:bounty platform:hackerone sev:high tech:android technique:race-window vuln:account-takeover vuln:auth-bypass vuln:business-logic

**Target:** Android app SMS OTP login/activation API (p.grabtaxi.com passenger v2 profiles)
**Root cause:** The activationsms resend endpoint had no rate limiting (only a 30s cooldown), while activate allowed 3 attempts before expiring the code. Resending resets the attempt budget, so an attacker gets unlimited guesses against a 4-digit code.
**Steps:**
1. Intercept the Android app login flow via proxy; identify `https://p.grabtaxi.com/api/passenger/v2/profiles/activationsms` (resend) and `https://p.grabtaxi.com/api/passenger/v2/profiles/activate` (verify).
2. Enter victim phone number with country code (no `+`) in the C# POC tool.
3. Tool submits 3 fixed guesses e.g. `1056, 1057, 1058` to the activate endpoint.
4. On failure, call activationsms to reset the code, wait 30s, repeat.
5. Loop yields ~8640 attempts/day against 9999 possible codes; eventually a guess is accepted and the response returns a session header for the victim account.
**How found:** Follow-up to a prior 2FA-bypass report on the Profile Edit endpoint; researcher hunted for an endpoint enabling horizontal escalation, proxied the Android app, and noticed the resend endpoint had only a 30s cooldown while verify capped at 3 attempts — the mismatch resets the guess budget.
**Exploitation:** Attacker needs only the victim's phone number. Using the resend endpoint to reset the 3-attempt counter every 30 seconds, they brute-force a 4-digit OTP over 24-72 hours until the server accepts one of their chosen codes, obtaining a session header and full account access. Side effect: mass SMS sending to the victim.
**Escalation:** Horizontal privilege escalation: any user's account reachable from an unauthenticated position using only phone number and country code.
**Insight:** When a verify endpoint caps attempts but a separate resend/regenerate endpoint resets that counter, the effective attempt limit is unbounded — check whether resend invalidates the old code or merely re-issues, and whether the cooldown is the only control. Short numeric OTPs plus any resend path are brute-forceable.