Thread by @Aacle_

10 Tips To Bypass 2FA
#2FA #bugbounty #bugbountytips #infosec

🧵(1/11)👇:

➡Response manipulation
The response is like: #2FA_Bypass #bugbounty

HTTP/1.1 404 Not Found
. . .
{"code": false}
. . .
Try to manipulate by changing {"code": true}

➡Status code manipulation
The response is : #2FA_Bypass #bugbounty

HTTP/1.1 404 Not Found
...
{"code": false}

Try to manipulate by changing :

HTTP/1.1 200 OK
...
{"code": false}

➡2FA Code in Response
Always check the response :#bugbounty
. . .
POST /req-2fa/
Host: vuln.com
. . .
email=[e-mail]

Try to manipulate like :
. . .
HTTP/1.1 200 OK
. . .
{"email": "[e-mail]", "code": "101010"}
. . .
here 1->True & 0 -> False

➡JS Files may contain info about the 2FA Code (Rare case)
➡Bruteforce the 2FA code ( try to bypass rate limit if it is there )

#2FA_Bypass #bugbounty #bugbountytips

➡Missing 2FA Code integrity validation, code for any user account can be used #2FA_Bypass #bugbounty

POST /2fa/
Host: vuln.com
...
email=[e-mail]&code=382923

Try to change email id to victim email id here and code should be remain same

➡No CSRF protection on disabling 2FA, also there is no auth confirmation. #2FA_Bypass #bugbounty
➡2FA gets disabled on password change/email change.
➡Clickjacking on 2FA disabling page, by iframing the 2FA Disabling page and lure the victim to disable the 2FA.

➡Enabling 2FA doesn't expire previously active sessions, if the session is already hijacked and there is a session timeout vuln.
➡2FA code reusability, same code can be reused.
➡Enter code 000000 :-> #bugbounty
. . .
POST /2fa/
Host: vuln.com
. . .
code=00000

➡Enter code "null"
. . .
POST /2fa/
Host: vuln.com
. . .
code=null

Reference : @harshbothra_

#hacking #cybersecurity #infosec

Thanks You To Read😃👍

Hope you like these all | Do Follow For More

&

Checkout my bugbountytips cybersecurity telegram Group :
t.me/bugbountyresou…