MFA skip / race / tamper
The UI is not the enforcement point. Hit the session issuer, the mobile API, and the OTP counter.
Tags: 2fa, otp, ato
Techniques
Skip the verify step
Login returns a pre-mfa token. Call the same endpoint the app calls after a good OTP, or an older /session.
POST /api/session with the pre-mfa cookiePOST /api/mfa/skip
Response tamper
SPA trusts mfa_required:false or status:ok in the JSON. Flip it in the proxy.
{"mfa_required":false}{"status":"ok","mfa":false}
Race the counter
HTTP/2 single-packet many OTPs so lockout increments once.
N parallel POST /mfa/verify
Backup codes / remember-me
Backup codes are often 8-char with no lockout. Remember-this-device cookies are IDORs.
backup_code=00000000device_id=VICTIM