hacktricks/src/pentesting-web/phone-number-injections.md

Phone Number Injections

{{#include ../banners/hacktricks-training.md}}

It's possible to add strings at the end the phone number that could be used to exploit common injections (XSS, SQLi, SSRF...) or even to bypass protections:

OTP Bypass / Bruteforce would work like this:

References

• https://www.youtube.com/watch?app=desktop&v=4ZsTKvfP1g0

{{#include ../banners/hacktricks-training.md}}