mfa-bypass.md (3780B)
1 --- 2 title: "MFA Bypasses" 3 topic: "Account Takeover" 4 topicSlug: "account-takeover" 5 sourcePath: "Account Takeover/mfa-bypass.md" 6 sourceUrl: "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/3ac27901c711/Account%20Takeover/mfa-bypass.md" 7 sha: "3ac27901c711" 8 isReadme: false 9 --- 10 11 # MFA Bypasses 12 13 > Multi-Factor Authentication (MFA) is a security measure that requires users to provide two or more verification factors to gain access to a system, application, or network. It combines something the user knows (like a password), something they have (like a phone or security token), and/or something they are (biometric verification). This layered approach enhances security by making unauthorized access more difficult, even if a password is compromised. 14 > MFA Bypasses are techniques attackers use to circumvent MFA protections. These methods can include exploiting weaknesses in MFA implementations, intercepting authentication tokens, leveraging social engineering to manipulate users or support staff, or exploiting session-based vulnerabilities. 15 16 ## Summary 17 18 * [Response Manipulation](#response-manipulation) 19 * [Status Code Manipulation](#status-code-manipulation) 20 * [2FA Code Leakage in Response](#2fa-code-leakage-in-response) 21 * [JS File Analysis](#js-file-analysis) 22 * [2FA Code Reusability](#2fa-code-reusability) 23 * [Lack of Brute-Force Protection](#lack-of-brute-force-protection) 24 * [Missing 2FA Code Integrity Validation](#missing-2fa-code-integrity-validation) 25 * [CSRF on 2FA Disabling](#csrf-on-2fa-disabling) 26 * [Password Reset Disable 2FA](#password-reset-disable-2fa) 27 * [Backup Code Abuse](#backup-code-abuse) 28 * [Clickjacking on 2FA Disabling Page](#clickjacking-on-2fa-disabling-page) 29 * [Enabling 2FA doesn't expire Previously active Sessions](#enabling-2fa-doesnt-expire-previously-active-sessions) 30 * [Bypass 2FA by Force Browsing](#bypass-2fa-by-force-browsing) 31 * [Bypass 2FA with null or 000000](#bypass-2fa-with-null-or-000000) 32 * [Bypass 2FA with array](#bypass-2fa-with-array) 33 34 ## 2FA Bypasses 35 36 ### Response Manipulation 37 38 If response is `"success":false` 39 Change it to `"success":true` 40 41 ### Status Code Manipulation 42 43 If Status Code is **4xx** 44 Try changing it to **200 OK** and see if it bypass restrictions 45 46 ### 2FA Code Leakage in Response 47 48 Check the response of the 2FA Code Triggering Request for leaked code. 49 50 ### JS File Analysis 51 52 Rare but some JS Files may contain info about the 2FA Code, worth giving a shot 53 54 ### 2FA Code Reusability 55 56 Same code can be reused 57 58 ### Lack of Brute-Force Protection 59 60 Possible to brute-force any length 2FA Code 61 62 ### Missing 2FA Code Integrity Validation 63 64 Code for any user account can be used to bypass the 2FA 65 66 ### CSRF on 2FA Disabling 67 68 No CSRF Protection on disabling 2FA, also there is no auth confirmation 69 70 ### Password Reset Disable 2FA 71 72 2FA gets disabled on password change/email change 73 74 ### Backup Code Abuse 75 76 Bypassing 2FA by abusing the Backup code feature 77 Use the above-mentioned techniques to bypass the Backup Code to remove/reset 2FA restrictions 78 79 ### Clickjacking on 2FA Disabling Page 80 81 Iframing the 2FA Disabling page and social engineering victim to disable the 2FA 82 83 ### Enabling 2FA doesn't expire Previously active Sessions 84 85 If the session is already hijacked and there is a session timeout vulnerability 86 87 ### Bypass 2FA by Force Browsing 88 89 If the application redirects to `/my-account` url upon login while 2FA is disabled, try replacing `/2fa/verify` with `/my-account` while 2FA is enabled to bypass verification. 90 91 ### Bypass 2FA with null or 000000 92 93 Enter the code **000000** or **null** to bypass 2FA protection. 94 95 ### Bypass 2FA with array 96 97 ```json 98 { 99 "otp":[ 100 "1234", 101 "1111", 102 "1337", // GOOD OTP 103 "2222", 104 "3333", 105 "4444", 106 "5555" 107 ] 108 } 109 ```