Thread by @SaraBadran18

2FA Bypass Techniques thread 🔥🐞🔓
-------------------------

📌2FA Code Leakage in Response:

You can intercept otp using burpsuite and inspect http response and check if the 2FA code leaked

#hackerone #BugBounty #bugbountytips #BugBountyTip

2. JS File Analysis:
----------------

📌Analyze all the JS Files that are referred in the response to see if any JS file contains information that can help bypass 2FA code.

#hackerone #BugBounty #bugbountytips
#hackeronereport #Bugbountywriteupspublished #BugBountyTip

3. Lack of brute-Force Protection:
-----------------
📌type 2FA code and capture request using burpsuite
📌send request to intruder and send request for 100–200 times .
📌At 2FA Code Verification page, try to brute-force for valid 2FA and see if there is any success.

4. Missing 2FA Code Integrity Validation:
-------------------
📌Request a 2FA code from the attacker’s account.

📌Use this valid 2FA code in the victim 2FA Request and see if it bypasses the 2FA protection.

#hackerone #BugBounty #bugbountytips
#bugbountytips
#bugbountytip

5.2FA Refer Check Bypass:
----------------
📌navigate to the page which comes after 2FA or any other authenticated page of the application.
If there is no success, change the refer header to the 2FA page URL.

#hackerone #BugBounty #bugbountytips
#bugbountytips
#bugbountytip

6. Enabling 2FA Doesn’t Expire Previous Session:
-------------------
In this scenario, if an attacker hijacks an active session before 2FA, it is possible to carry out all functions without a need for 2FA.

#hackerone #BugBounty #bugbountytips
#bugbountytips
#bugbountytip

7. Clickjacking on 2FA Disable Feature:
--------------------

Try to iframe the page where the application allows a user to disable 2FA.

#hackerone #BugBounty #bugbountytips
#bugbountytip

8. Response Manipulation:
----------------

📌 Check response of the 2FA Request.

📌 If you observe “Success”:false, change this to “Success”:true and see if it bypasses the 2FA.

#hackerone #BugBounty #bugbountytips
#bugbountytip

9. Status Code Manipulation:
----------------
📌If the Response Status Code is 4xx like 401, 402, etc.

📌 Change the response Status Code to “200 OK” and see if it bypasses the 2FA.

10. 2FA Code Reusability:
----------------

📌 Request a 2FA code and use it.

📌 Now, re-use the same 2FA code in another session and if it authenticated successfully, that’s a potential issue.

#hackerone #BugBounty
#bugbountytips
#bugbountytip

11. CSRF on 2FA Disable Feature:
---------------
📌 Navigate to 2FA Page and click on “Disable 2FA” and capture this request with Burp Suite & generate a CSRF PoC.

📌 Send this PoC to the victim, and check if CSRF happens successfully and remove the 2FA from the victim account.