Thread by @MeAsHacker_HNA

#Secret6
8 Awesome 2FA Bypass Techniques 🗝️

#bugbountytips 🧵👇🏻

https://twitter.com/MeAsHacker_HNA/status/1528680753449603075

1⃣ Access Next Endpoint Directly

- Just try to access the next endpoint directly
- If this doesn't work, try to change the Referrer header as if you came from the 2FA page

2⃣ Sharing Unused Code

- Check if you can get for your account a token and try to use it to bypass the 2FA in a different account.

3⃣ Leaked Code

- Is the token leaked on a response from the web application?

4⃣ Password Reset Function

- In almost all web applications the password reset function automatically logs the user into the application after the reset procedure is completed.

5⃣ Reuse 2FA Code

- Also, try requesting multiple 2FA codes and see if previously requested Codes expire or not when a new code is requested

6⃣ Brute Force

- There is any limit in the amount of codes that you can try, so you can just brute force it.

7⃣ Response Manipulation

- Change failed response to success response
- Change failed status code to success status code

8⃣ Rate Limit Bypass

- Using Similar Endpoints: /sign-up --> /Sign-up
- Blank char in params: code=1234%0a
- Change Origin IP using header
- Add extra params: /resetpwd?someparam=1

8 Awesome 2FA Bypass Techniques
By 'HackTricks'
github.com/NafisiAslH/Kno…