hunt-mfa-bypass

Autonomous Testing Priority

Try workflow bypasses before brute force — they're faster and more likely to succeed.

Pattern 1 — Skip the MFA step entirely (most automatable):

1. Login with valid credentials → receive a "pre-MFA" session state
2. Without completing MFA, directly access a protected resource (/dashboard, /api/me, /account/profile)
3. If the response returns user data → MFA is enforced only in the UI, not server-side = Critical

Pattern 2 — OTP replay (reuse a consumed code):

1. Complete a valid MFA flow to get a working OTP
2. Log out, log in again with the same credentials
3. Submit the same OTP again
4. If accepted → OTP is not invalidated after use

Pattern 3 — Submit obviously wrong OTP, observe response: Try submitting 000000 or 123456. If the response is 200 or returns a session token, OTP validation is broken or client-side only.