web-vuln-mfa-bypass

What this skill does

Systematically tests Multi-Factor Authentication (MFA) implementations for bypass vulnerabilities including missing rate limiting, OTP reuse, response manipulation, race conditions on OTP submission, direct navigation to post-MFA pages, backup code handling flaws, MFA disable without re-verification, session fixation pre-MFA, predictable OTP values, and client-side MFA state storage.

When to use

• When auditing a web application's MFA or 2FA implementation
• When testing TOTP, SMS OTP, email OTP, or push-notification based MFA flows
• When verifying whether MFA can be bypassed to gain unauthorized account access
• When evaluating backup code security or account recovery flows for MFA-enrolled users

Prerequisites

• curl must be installed
• parallel (GNU parallel) must be installed for race condition tests: apt install parallel
• Valid test account with MFA enrolled
• Knowledge of the application's MFA verification endpoint and parameter names

Inputs

Variable	Description	Example
BASE_URL	Base URL of the application	https://app.example.com
MFA_ENDPOINT	Endpoint that accepts OTP submission	/api/auth/mfa/verify
POST_MFA_PAGE	Page only accessible after successful MFA	/dashboard
SESSION_COOKIE	Session cookie value after username/password login (pre-MFA state)	session=abc123
KNOWN_OTP	Valid OTP obtained via authenticator app (for reuse test)	123456
MFA_PARAM	POST parameter name for OTP value	code

Workflow

Step 1: Map the MFA flow

BASE_URL="https://app.example.com"
MFA_ENDPOINT="/api/auth/mfa/verify"
POST_MFA_PAGE="/dashboard"
SESSION_COOKIE="session=abc123"
KNOWN_OTP="123456"
MFA_PARAM="code"

FULL_MFA_URL="${BASE_URL}${MFA_ENDPOINT}"
FULL_POST_MFA="${BASE_URL}${POST_MFA_PAGE}"

echo "=== Step 1: Map MFA flow ==="
echo "[+] MFA verification endpoint: $FULL_MFA_URL"
echo "[+] Post-MFA page: $FULL_POST_MFA"

# Check what parameters the MFA endpoint accepts
echo ""
echo "--- OPTIONS probe ---"
curl -s -X OPTIONS "$FULL_MFA_URL" \
  -H "Cookie: $SESSION_COOKIE" \
  --max-time 10 \
  -D - -o /dev/null \
  | grep -iE "^(HTTP|Allow|Content-Type):"

# Baseline: submit obviously wrong OTP
echo ""
echo "--- Baseline (wrong OTP: 000000) ---"
curl -s -X POST "$FULL_MFA_URL" \
  -H "Cookie: $SESSION_COOKIE" \
  -H "Content-Type: application/json" \
  --data "{\"${MFA_PARAM}\": \"000000\"}" \
  --max-time 10
echo ""