How do I install the Web Mfa Bypass skill?

Run npx skillmds@latest add noorqureshi/web-mfa-bypass in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Web Mfa Bypass safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Web Mfa Bypass?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Web Mfa Bypass free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Web Mfa Bypass?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Web Mfa Bypass by noorqureshi — Agent Skill

Name: Web Mfa Bypass
Author: NoorQureshi

Web Mfa Bypass

Defeat a second authentication factor — OTP/TOTP, SMS, push, or backup codes. Load when login has a 2FA/MFA step and you want to reach the account without the factor, on "2FA bypass", "OTP brute", "MFA", or during account-takeover work. Signals: an OTP/verification screen after password, a "verify your device" step, `/verify`, `/2fa`, `otp`/`code` parameters.

NoorQureshi fc498cc 2.3 KB Updated Sep 17, 2026

File contents

2FA / MFA bypass

When it applies

Authentication has a second step after the password. MFA is only as strong as its enforcement — the common flaws are in the flow, not the crypto, and each is worth a quick check before assuming the factor is solid.

Why it works

The second factor is usually bolted onto a stateful flow, and the server often trusts the client to follow it. Skip the step, replay a state, or brute a short code with no rate limit, and the factor never actually gates access.

Method — work the checklist

Missing server-side enforcement: complete step 1, then request a post-auth endpoint directly (forced browsing) or reuse the step-1 session — if it works, 2FA is cosmetic.
No rate limit on the code: brute the 6-digit OTP (Turbo Intruder); watch for missing lockout, or a lockout you can reset by re-triggering send. Also test code reuse and non-expiry.
Response/flag manipulation: flip "mfa_required":true→false, verified:false→true, or a 200/302 the client trusts to advance.
Flow/logic: change the account/email between step 1 and 2 (bind your factor to their session), downgrade to a factor you control, or use password-reset to skip MFA entirely.
Backup/remember: weak/guessable backup codes, a "remember this device" cookie that's static or forgeable, or OAuth/SSO paths that skip MFA.

Gotchas

Account lockout can burn the test account — throttle and use your own accounts.
Distinguish "reached the OTP screen" from "reached the account" — only the latter is the bypass.
Some apps enforce MFA at sensitive actions, not login — test the step-up too.

Verify success

You reach the authenticated account (or perform the MFA-gated action) without presenting a valid second factor, reproducibly from a clean session with test accounts.

References

PortSwigger 2FA bypass labs; OWASP Authentication Testing (OTP/MFA); OWASP ASVS auth requirements.

---name: web-mfa-bypassdescription: Defeat a second authentication factor — OTP/TOTP, SMS, push, or backup codes. Load when login has a 2FA/MFA step and you want to reach the account without the factor, on "2FA bypass", "OTP brute", "MFA", or during account-takeover work. Signals: an OTP/verification screen after password, a "verify your device" step, `/verify`, `/2fa`, `otp`/`code` parameters.---# 2FA / MFA bypass## When it appliesAuthentication has a second step after the password. MFA is only as strong as its enforcement — thecommon flaws are in the *flow*, not the crypto, and each is worth a quick check before assuming thefactor is solid.## Why it worksThe second factor is usually bolted onto a stateful flow, and the server often trusts the client tofollow it. Skip the step, replay a state, or brute a short code with no rate limit, and the factornever actually gates access.## Method — work the checklist1. **Missing server-side enforcement**: complete step 1, then request a post-auth endpoint directly (forced browsing) or reuse the step-1 session — if it works, 2FA is cosmetic.2. **No rate limit on the code**: brute the 6-digit OTP (Turbo Intruder); watch for missing lockout, or a lockout you can reset by re-triggering send. Also test code **reuse** and **non-expiry**.3. **Response/flag manipulation**: flip `"mfa_required":true`→`false`, `verified:false`→`true`, or a 200/302 the client trusts to advance.4. **Flow/logic**: change the account/email between step 1 and 2 (bind your factor to their session), downgrade to a factor you control, or use password-reset to skip MFA entirely.5. **Backup/remember**: weak/guessable backup codes, a "remember this device" cookie that's static or forgeable, or OAuth/SSO paths that skip MFA.## Gotchas- Account lockout can burn the test account — throttle and use your own accounts.- Distinguish "reached the OTP screen" from "reached the account" — only the latter is the bypass.- Some apps enforce MFA at sensitive actions, not login — test the step-up too.## Verify successYou reach the authenticated account (or perform the MFA-gated action) without presenting a validsecond factor, reproducibly from a clean session with test accounts.## ReferencesPortSwigger 2FA bypass labs; OWASP Authentication Testing (OTP/MFA); OWASP ASVS auth requirements.

Frequently asked questions