# MFA

{% hint style="info" %}
Broken Multi-Factor Authentication (MFA) logic occurs when an attacker can bypass or exploit weaknesses in the MFA implementation, allowing unauthorized access despite the presence of additional authentication factors.
{% endhint %}

{% hint style="danger" %}
This can lead to unauthorized account access, as attackers may exploit flaws to bypass MFA protections and gain access to sensitive information or systems.
{% endhint %}

{% hint style="success" %}
Ensure MFA is properly integrated and enforced, use strong and diverse authentication factors, regularly review and update MFA mechanisms, and monitor for suspicious activities or bypass attempts.
{% endhint %}

## Simple 2FA Bypass <a href="#simple-2fa-bypass" id="simple-2fa-bypass"></a>

> _The example below is based on PostSwigger's_ [_2FA simple bypass_](https://portswigger.net/web-security/authentication/multi-factor/lab-2fa-simple-bypass) _lab._

We first need to login in as a normal user and understand how the 2FA process works (Figure 1).

<figure><img src="https://2056709691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqURPjUnKKhebI962QD8%2Fuploads%2FkCGSSCMIkpB5SFrcH5Fp%2Fweb_auth_mfa_1.png?alt=media&#x26;token=9650d8ec-9ef6-4ff2-99ff-5962fdb079a0" alt=""><figcaption><p>Figure 1: Using the application as intended and understanding its behaviour.</p></figcaption></figure>

We can also inspect what's happening behind the scene during this 2FA process (Figure 2).

<figure><img src="https://2056709691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqURPjUnKKhebI962QD8%2Fuploads%2F3n8SrakjW2XhaE9lNOrx%2Fweb_auth_mfa_2.avif?alt=media&#x26;token=204719da-92b9-49fd-9fc9-35f6fa4071af" alt=""><figcaption><p>Figure 2: Intercepting the traffic associated with the 2FA process.</p></figcaption></figure>

It seems that each authentication step issues a different session cookie (Figure 2). There is a chance that we can use either of the two cookies to access the user's account. If this is the case, it means that the second authentication step is redundant and can be skipped altogether. We can test this by logging in as `carlos`, intercept the traffic, get the first session cookie, and then use it to access his account (Figure 3).

<figure><img src="https://2056709691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqURPjUnKKhebI962QD8%2Fuploads%2F8BXMIKJEt5wMjXQDzw4V%2Fweb_auth_mfa_3.avif?alt=media&#x26;token=57574942-1ab7-4386-ab9c-1a641dfdf671" alt=""><figcaption><p>Figure 3: Bypassing the second authentication step &#x26; accessing <code>carlos</code>'s account.</p></figcaption></figure>

## Broken 2FA logic <a href="#broken-2fa-logic" id="broken-2fa-logic"></a>

> _The example below is based on PostSwigger's_ [_2FA broken logic_](https://portswigger.net/web-security/authentication/multi-factor/lab-2fa-broken-logic) _lab._

As before, the first thing we need to do, is to try and understand how the authentication process works (Figure 4 & 5).

<figure><img src="https://2056709691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqURPjUnKKhebI962QD8%2Fuploads%2F88g5DTGsFvd3jkPyij2m%2Fweb_auth_mfa_4.avif?alt=media&#x26;token=49ecc4ef-dffb-4da7-b37a-11ef532e1e3b" alt=""><figcaption><p>Figure 4: Logging in as <code>wiener</code> and inspecting how the first part of the authentication process works.</p></figcaption></figure>

<figure><img src="https://2056709691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqURPjUnKKhebI962QD8%2Fuploads%2FVAeveo1qJNRjw00xZsnR%2Fweb_auth_mfa_5.png?alt=media&#x26;token=10429744-3f2a-4e32-83a2-3aa80436013d" alt=""><figcaption><p>Figure 5: Logging in as <code>wiener</code> and inspecting how the second part of the authentication process works.</p></figcaption></figure>

We can tamper with the cookie generated in the second step of the authentication process, and create a valid session cookie tied in the account `carlos` (Figure 6).

<figure><img src="https://2056709691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqURPjUnKKhebI962QD8%2Fuploads%2FXMdO3AIKKXBrlDwbXkCM%2Fweb_auth_mfa_6.png?alt=media&#x26;token=f9376ef8-8f4f-400b-872b-fa9f718a88e4" alt=""><figcaption><p>Figure 6: Creating a valid session cookie tied to <code>carlos</code>.</p></figcaption></figure>

Next, we can use this cookie to brute-force `carlos`'s `mfa-code` (Figure 7) and impersonate the user (Figure 8).

<figure><img src="https://2056709691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqURPjUnKKhebI962QD8%2Fuploads%2FP1KSCnIKeIENDhxKYJBY%2Fweb_auth_mfa_7.avif?alt=media&#x26;token=19852556-22fa-4523-bd50-450d8393a2a8" alt=""><figcaption><p>Figure 7: Brute-forcing <code>carlos</code>'s 4-digit code.</p></figcaption></figure>

> _The session cookie differs between Figure 7 & Figure 8 due to a lab reset._

<figure><img src="https://2056709691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqURPjUnKKhebI962QD8%2Fuploads%2FlJ73OQWwEPHq6d4AjQWF%2Fweb_auth_mfa_8.png?alt=media&#x26;token=0d219a49-b4f0-4dcb-9805-3632bf6a46e6" alt=""><figcaption><p>Figure 8: Impersonating user <code>carlos</code>.</p></figcaption></figure>

## Broken 2FA logic (2)

> _The example below is based on TCM's_ [_Practical Bug Bounty_](https://academy.tcm-sec.com/p/practical-bug-bounty) _course._

We should first go through the MFA process to understand how it works. We first login it with valid credentials (Figure 8.1), we then get a link to grab our code (Figure 8.2), and finally we enter our `username` and `mfa` code to log into the application (Figure 8.3).

<figure><img src="https://2056709691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqURPjUnKKhebI962QD8%2Fuploads%2F8OyR6WLVHWUgSMSqDdhd%2Fweb_auth_mfa_broken_logic2_1.png?alt=media&#x26;token=04e86b81-eb23-4866-9d3c-6556b125932b" alt=""><figcaption><p>Figure 8: The web application's MFA process.</p></figcaption></figure>

The last step of the MFA process is extremely weak as it only asks for our username and a predictable six-digit code. Thus, we can try and perform a BFA to the `mfa` code as `jeremy`. Unfortunately, the application breaks after a while, so we will need to find another solution.

We can check if the `mfa` code is tied to a specific user by logging in as `jessamy` (Figure 9.1) and modifying the username of the second authentication step to `jeremy` (Figure 9.3).

<figure><img src="https://2056709691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqURPjUnKKhebI962QD8%2Fuploads%2FOdFFODlQQJDZV9kKzJtx%2Fweb_auth_mfa_broken_logic2_2.png?alt=media&#x26;token=8e93b0bc-2c8c-4b60-9ffe-eb3db6b4dcf3" alt=""><figcaption><p>Figure 10: Bypassing the MFA process.</p></figcaption></figure>
