Thread by @harshbothra_

#learn365 Day-1: 2FA Bypass Techniques
1. Response Manipulation - In response if "success":false, change it to "success":true
2. Status Code Manipulation - If Status Code is 4xx, try to change it to 200 OK and see if it bypass restrictions.

(1/n)
#bugbountytips

(2/n)
3. 2FA Code Leakage in Response: Check the response of the 2FA Code Triggering Request to see if the code is leaked.
4. JS File Analysis: Rare but some JS Files may contain info about the 2FA Code, worth giving a shot.
5. 2FA Code Reusability: Same code can be reused.

(3/n)
6. Lack of Brute-Force Protection: Possible to brute-force any length 2FA Code.
7. Missing 2FA Code Integrity Validation: Code for any user acc can be used to bypass the 2FA
8. CSRF on 2FA Disabling: No CSRF Protection on disabling 2FA, also there is no auth confirmation.

(4/n)
9. Password Reset Disable 2FA: 2FA gets disabled on password change/email change.
10. Backup Code Abuse: Bypassing 2FA by abusing the Backup code feature. Use the above-mentioned techniques to bypass Backup Code to remove/reset 2FA restrictions.

(5/n)
11. Clickjacking on 2FA Disabling Page - Iframing the 2FA Disabling page and social engineering victim to disable the 2FA.
12. Enabling 2FA doesn't expire Previously active Sessions: If the session is already hijacked and there is a session timeout vuln. ........

(n/n)
... it can be exploited to disable 2FA.

Another great source to check about 2FA Bypasses: book.hacktricks.xyz/pentesting-web…

Add any missing technique which can be leveraged to bypass 2FA. Please note all rate-limiting/brute-force related are covered at one point only as one cause.