MFA / 2FA Bypass

Tags: 2fa, ato, otp, race

Level: advanced

Method

1. Map the flow

   Login returns a temp token, then /mfa/verify, then a session. Find every endpoint that issues a real session.

   Tools: Burp Suite

2. Skip

   Call the post-MFA endpoint with the temp token. Change the JSON from mfa_required:true to false. Hit the mobile API that might not know about MFA.

3. Brute and rate limit

   6-digit OTP is 1e6. If there is no lockout, or lockout is per-IP and you can rotate, it falls. Check backup codes too.

   Tools: ffuf

4. Race

   Submit many OTPs in one HTTP/2 burst so the counter does not keep up. Or race enable-MFA vs disable.

   Tools: Burp Suite

5. Leaks

   OTP in response body, in logs, in email preview APIs, in support tools.

Field notes

• Response manipulation is still shockingly common on SPA logins.
• If MFA is cookie-gated on www but not on api., write it as ATO.

References

• https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/04-Authentication_Testing/11-Testing_Multi-Factor_Authentication