2FA Bypass Techniques thread 🔥🐞🔓
-------------------------
📌2FA Code Leakage in Response:
You can intercept otp using burpsuite and inspect http response and check if the 2FA code leaked
#hackerone #BugBounty #bugbountytips #BugBountyTip
-------------------------
📌2FA Code Leakage in Response:
You can intercept otp using burpsuite and inspect http response and check if the 2FA code leaked
#hackerone #BugBounty #bugbountytips #BugBountyTip
2. JS File Analysis:
----------------
📌Analyze all the JS Files that are referred in the response to see if any JS file contains information that can help bypass 2FA code.
#hackerone #BugBounty #bugbountytips
#hackeronereport #Bugbountywriteupspublished #BugBountyTip
----------------
📌Analyze all the JS Files that are referred in the response to see if any JS file contains information that can help bypass 2FA code.
#hackerone #BugBounty #bugbountytips
#hackeronereport #Bugbountywriteupspublished #BugBountyTip
3. Lack of brute-Force Protection:
-----------------
📌type 2FA code and capture request using burpsuite
📌send request to intruder and send request for 100–200 times .
📌At 2FA Code Verification page, try to brute-force for valid 2FA and see if there is any success.
-----------------
📌type 2FA code and capture request using burpsuite
📌send request to intruder and send request for 100–200 times .
📌At 2FA Code Verification page, try to brute-force for valid 2FA and see if there is any success.
4. Missing 2FA Code Integrity Validation:
-------------------
📌Request a 2FA code from the attacker’s account.
📌Use this valid 2FA code in the victim 2FA Request and see if it bypasses the 2FA protection.
#hackerone #BugBounty #bugbountytips
#bugbountytips
#bugbountytip
-------------------
📌Request a 2FA code from the attacker’s account.
📌Use this valid 2FA code in the victim 2FA Request and see if it bypasses the 2FA protection.
#hackerone #BugBounty #bugbountytips
#bugbountytips
#bugbountytip
5.2FA Refer Check Bypass:
----------------
📌navigate to the page which comes after 2FA or any other authenticated page of the application.
If there is no success, change the refer header to the 2FA page URL.
#hackerone #BugBounty #bugbountytips
#bugbountytips
#bugbountytip
----------------
📌navigate to the page which comes after 2FA or any other authenticated page of the application.
If there is no success, change the refer header to the 2FA page URL.
#hackerone #BugBounty #bugbountytips
#bugbountytips
#bugbountytip
6. Enabling 2FA Doesn’t Expire Previous Session:
-------------------
In this scenario, if an attacker hijacks an active session before 2FA, it is possible to carry out all functions without a need for 2FA.
#hackerone #BugBounty #bugbountytips
#bugbountytips
#bugbountytip
-------------------
In this scenario, if an attacker hijacks an active session before 2FA, it is possible to carry out all functions without a need for 2FA.
#hackerone #BugBounty #bugbountytips
#bugbountytips
#bugbountytip
7. Clickjacking on 2FA Disable Feature:
--------------------
Try to iframe the page where the application allows a user to disable 2FA.
#hackerone #BugBounty #bugbountytips
#bugbountytip
--------------------
Try to iframe the page where the application allows a user to disable 2FA.
#hackerone #BugBounty #bugbountytips
#bugbountytip
8. Response Manipulation:
----------------
📌 Check response of the 2FA Request.
📌 If you observe “Success”:false, change this to “Success”:true and see if it bypasses the 2FA.
#hackerone #BugBounty #bugbountytips
#bugbountytip
----------------
📌 Check response of the 2FA Request.
📌 If you observe “Success”:false, change this to “Success”:true and see if it bypasses the 2FA.
#hackerone #BugBounty #bugbountytips
#bugbountytip
9. Status Code Manipulation:
----------------
📌If the Response Status Code is 4xx like 401, 402, etc.
📌 Change the response Status Code to “200 OK” and see if it bypasses the 2FA.
----------------
📌If the Response Status Code is 4xx like 401, 402, etc.
📌 Change the response Status Code to “200 OK” and see if it bypasses the 2FA.
10. 2FA Code Reusability:
----------------
📌 Request a 2FA code and use it.
📌 Now, re-use the same 2FA code in another session and if it authenticated successfully, that’s a potential issue.
#hackerone #BugBounty
#bugbountytips
#bugbountytip
----------------
📌 Request a 2FA code and use it.
📌 Now, re-use the same 2FA code in another session and if it authenticated successfully, that’s a potential issue.
#hackerone #BugBounty
#bugbountytips
#bugbountytip
11. CSRF on 2FA Disable Feature:
---------------
📌 Navigate to 2FA Page and click on “Disable 2FA” and capture this request with Burp Suite & generate a CSRF PoC.
📌 Send this PoC to the victim, and check if CSRF happens successfully and remove the 2FA from the victim account.
---------------
📌 Navigate to 2FA Page and click on “Disable 2FA” and capture this request with Burp Suite & generate a CSRF PoC.
📌 Send this PoC to the victim, and check if CSRF happens successfully and remove the 2FA from the victim account.
جاري تحميل الاقتراحات...