How I was Able To Bypass Email Verification

Hello Masters and Learner I hope you are doing well and always put your efforts to secure the world so that no can get benefits unethically. the main reason why i am writing this article is that sometime when we lose hope that time we just need to think outside of the box xD . While testing h1 private site for finding some basic issues i found that the site have email verification mechanism. The main function of this mechanism is to send a 4 digit(OTP) verification code and email link to the user provided email.I thought how can i bypass it :)

Try to Brute force verification code but failed they have rate limit there i thought that i m failed to get bypass.

But wait try one more time i go through burp http Req history and found this request interesting which is used for adding email. Request: POST /registerNewUser HTTP/1.1 Host: www.site.com User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:61.0) Gecko/20100101 Firefox/61.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: https://www.site.comlogin Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 171 Cookie: foo DNT: 1 Connection: close givenName=test&familyName=test&gender=0&email=test@gmail.com&tz=20&agreePrivAndTC=true&password=value&action=send-verification-web I Tried to Add Such test@gmail.com as email i get shocked by viewing the Repose because it leaking the verification link. Response: HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Jun 2018 06:47:49 GMT Content-Type: application/json; charset=utf-8 Content-Length: 54 Connection: close X-Powered-By: Express Cache-Control: private, no-cache, no-store, must-revalidate Expires: -1 Pragma: no-cache Access-Control-Allow-Origin: * X-Frame-Options: SAMEORIGIN ETag: W/“36-zOgjh98O1kXD4SR66HqUdT6UxdM” Strict-Transport-Security: max-age=63072000; includeSubdomains; preload {“key”:“the verification link”,“success”:1} After seeing the verification link my feeling was.

I just Reported the issue and rewarded $200 bounty for this issue.