MFA / 2FA bypass
MFA that is checked in the UI and not on the API is not MFA. Test skip, brute, race, backup codes, and the mobile app.
Playbooks
- MFA / 2FA Bypass - MFA that is checked in the UI and not on the API is not MFA. Test skip, brute, race, and backup codes.
Gadgets
- Framable authenticated page - Usually P5. Becomes real when a sensitive state-changing UI is framable (disable 2FA, OAuth approve, delete, wire).
- Race / limit overrun - Coupon once, gift-card drain, extra votes, extra MFA tries, extra password-reset, extra invitations.
- TOCTOU / last-write race - Limit, coupon, MFA, balance, or unique-constraint checks that are check-then-act without a transaction. HTTP/2 single-packet makes this cheap.
Payloads
- MFA / OTP - Skip, tamper, and race probes. Do not brute a production OTP pool past the program's rate-limit rule.
Bypasses
- Rate-limit bypass - Get more attempts than the limiter intends - essential for brute-force, OTP and coupon/voucher abuse.
- MFA skip / race / tamper - The UI is not the enforcement point. Hit the session issuer, the mobile API, and the OTP counter.
Checklists
- Authentication / ATO - Account takeover is a chain. Inventory every step of how an identity becomes a session.
Workflows
- Identity state machine - Model registration, verification, recovery, MFA, session refresh, logout, and account deletion as explicit states. Look for state transitions that grant more access than the prior state permits.
Questions
Response tamper still works?
If the SPA trusts mfa_required:false, yes. The server must issue a real session. Prove it with a token you can use.
Backup codes?
Often 8-char with no lockout. That is a brute primitive, not automatically ATO.
This page is the public form of hunt_brief("2fa") on the MCP connector. Authorized testing only.