MFA / 2FA bypass

Skill: Session, cookies, and passkeys

Ask: Which cookie or token does the server trust, and can recovery issue a session the primary login would not?

Stop: You can name the cookie or token, the recovery path, and whether a second browser still holds a session after logout.

Open the skill

Practice the class in the browser: PortSwigger Web Security Academy. The lab is theirs. This page is the stop condition and the disclosures.

Checklists

• Authentication / ATO - Account takeover is a chain. Inventory every step of how an identity becomes a session.
• Passkeys and WebAuthn - A passkey is only as strong as registration, recovery, and the session it mints. Map the ceremony before you treat passwordless as finished.

Disclosures

• A WebAuthn record could be updated from the public key - Insecure direct object reference

Playbooks

• MFA / 2FA Bypass - MFA that is checked in the UI and not on the API is not MFA. Test skip, brute, race, and backup codes.
• Passkeys and WebAuthn - A passkey is an origin-bound credential. The finding is usually the path around it: recovery, a second factor that still mints a full session, or a registration that attaches a credential to the wrong account.

Tools

• Burp Suite - The industry-standard intercepting proxy for manual web testing. Community edition is free; Pro adds the active scanner and automation.

Payloads

• MFA / OTP - Skip, tamper, and race probes. Do not brute a production OTP pool past the program's rate-limit rule.

Bypasses

• MFA skip / race / tamper - The UI is not the enforcement point. Hit the session issuer, the mobile API, and the OTP counter.

Questions

Response tamper still works?

If the SPA trusts mfa_required:false, yes. The server must issue a real session. Prove it with a token you can use.

Backup codes?

Often 8-char with no lockout. That is a brute primitive, not automatically ATO.

This page is the linked pack hunt_brief("2fa") returns on the MCP connector. Authorized testing only.