web-vuln-mfa-bypass

What this skill does

Systematically tests Multi-Factor Authentication (MFA) implementations for bypass vulnerabilities including missing rate limiting, OTP reuse, response manipulation, race conditions on OTP submission, direct navigation to post-MFA pages, backup code handling flaws, MFA disable without re-verification, session fixation pre-MFA, predictable OTP values, and client-side MFA state storage.

When to use

• When auditing a web application's MFA or 2FA implementation
• When testing TOTP, SMS OTP, email OTP, or push-notification based MFA flows
• When verifying whether MFA can be bypassed to gain unauthorized account access
• When evaluating backup code security or account recovery flows for MFA-enrolled users

Prerequisites

• curl must be installed
• parallel (GNU parallel) must be installed for race condition tests: apt install parallel
• Valid test account with MFA enrolled
• Knowledge of the application's MFA verification endpoint and parameter names

Inputs