If you are thinking you are safe internet user and your digital assets, digital presence is secured because you are using two-factor authentication, hold on…
I will describe how these two-factor authentications can be bypass.
Following are some 2FA Bypass Vulnerabilities techniques:
In response, if "success": false Change it to "success": true
If Status Code is 4xx try to change it to 200 OK and see if it bypasses restrictions
Check the response of the two-factor authentication (2FA) Code Triggering Request to see if the code is leaked
Rare but some JS Files may contain info about the 2FA Code, worth giving a shot
The same code can be reused
Possible to brute-force any length 2FA Code
Code for any user account can be used to bypass the 2FA or two-factor authentication
No CSRF Protection on disabling 2FA, also there is no auth confirmation
2FA gets disabled on password change/email change 2 | P a g e Debraj Basak Security Research Analyst Indian School of Ethical Hacking
Bypassing 2FA by abusing the Backup code feature Use the above-mentioned techniques to bypass Backup Code to remove/reset 2FA reset restrictions
I-framing the 2FA Disabling page and social engineering victim to disable the 2FA
If the session is already hijacked and there is a session timeout vulnerability
Enter the code 000000 or null to bypass two-factor authentication protection. Steps: - 1. Enter “null” in 2FA code 2. Enter 000000 in 2FA code 3. Send empty code 4. Open a new tab in the same browser and check if other API endpoints are accessible without entering 2FA
So, be very careful while writing the web service program and very carefully deal with the API.
Lastly don't share your credentials with anyone and don't become a prey of a phishing attack.
Get all updates related to cyber security, cyber faults, crimes happening in the world related to cyber world from Indian School of Ethical Hacking (ISOEH), most trusted and known cyber security institute in Kolkata. Stay Secure!
The recent pandemic was unexpected and unknown to most part of the world. It has changed our life and we are slowly adapting to our new lifestyle. The risks associated with the new lifestyle, both personal & corporate, are unknown to most of us.Read Details