Hunt Mfa Bypass
Hunt MFA / 2FA bypass, 7 distinct patterns.
Install
npx skills add elementalsouls/Claude-BugHunter --skill hunt-mfa-bypass -g -a claude-code -y- Repository
- elementalsouls/Claude-BugHunter5.4k
- Category
- Engineering
- Updated
- 3d ago
- License
- MIT
- Context cost
- Mediumabout 1,929 tokens
- Runs scripts
- No, instructions only
What it does
Hunt MFA / 2FA bypass, 7 distinct patterns. (1) MFA not enforced on sensitive endpoints (password change, email change accept without MFA challenge), (2) MFA-step skip via direct navigation to post-login URL, (3) MFA-token replay (same code accepted twice), (4) brute-force the 6-digit OTP without rate limit (10^6 attempts at server speed), (5) race condition on OTP validation, (6) recovery-code dump via /api/me, (7) backup factor downgrade (SMS factor with no rate limit). Plus the chain: cookie theft + password oracle + no step-up = ATO without MFA challenge. Detection: trace auth flow in Burp, find every state transition, check if MFA is middleware-gated vs per-endpoint, check OTP entropy and rate limit on OTP-validate. Validate: attacker session reaching post-MFA state. Use when hunting auth bypass, MFA flows, chaining primitives toward ATO.
Autonomous Testing Priority
Try workflow bypasses before brute force, they're faster and more likely to succeed.
Pattern 1, Skip the MFA step entirely (most automatable):
- Login with valid credentials → receive a "pre-MFA" session state
- Without completing MFA, directly access a protected resource (
/dashboard,/api/me,/account/profile) - If the response returns user data → MFA is enforced only in the UI, not server-side = Critical
Pattern 2, OTP replay (reuse a consumed code):
- Complete a valid MFA flow to get a working OTP
- Log out, log in again with the same credentials
- Submit the same OTP again
- If accepted → OTP is not invalidated after use
Pattern 3, Submit obviously wrong OTP, observe response:
Try submitting 000000 or 123456. If the response is 200 or returns a session token, OTP validation is broken or client-side only.
