mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-30 00:20:59 +00:00
151 lines
8.4 KiB
Markdown
151 lines
8.4 KiB
Markdown
|
|
|
|
<details>
|
|
|
|
<summary><strong>HackTricks in </strong><a href="https://twitter.com/carlospolopm"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch</strong></a> <strong>Wed - 18.30(UTC) 🎙️</strong> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
|
|
|
- Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
|
|
|
- Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
|
|
|
- Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
|
|
|
- **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
|
|
|
- **Share your hacking tricks by submitting PRs to the [hacktricks repo](https://github.com/carlospolop/hacktricks) and [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)**.
|
|
|
|
</details>
|
|
|
|
|
|
# **Bypassing two-factor authentication**
|
|
|
|
## **Direct bypass**
|
|
|
|
To bypass 2FA, just **try to access the next endpoint directly** (you need to know the path of the next endpoint). If this doesn't work, try to change the **Referrer header** as if you came from the 2FA page.
|
|
|
|
## **Reusing token**
|
|
|
|
Maybe you can reuse a previously used token inside the account to authenticate.
|
|
|
|
## Sharing unused tokens
|
|
|
|
Check if you can get the token from your account and try to use it to bypass the 2FA in a different account.
|
|
|
|
## Leaked Token
|
|
|
|
Is the token leaked on a response from the web application?
|
|
|
|
## Session permission
|
|
|
|
Using the same session start the flow using your account and the victim's account. When reaching the 2FA point on both accounts, complete the 2FA with your account but do not access the next part. Instead of that, try to access the next step with the victim's account flow. If the back-end only set a boolean inside your sessions saying that you have successfully passed the 2FA you will be able to bypass the 2FA of the victim.
|
|
|
|
## **Password reset function**
|
|
|
|
In almost all web applications the **password reset function automatically logs the user into the application** after the reset procedure is completed.\
|
|
Check if a **mail **is sent with a **link **to **reset the password** and if you can **reuse** that **link **to reset the password as **many times as you want** (even if the victim changes his email address).
|
|
|
|
## OAuth
|
|
|
|
If you can compromise the account of the user in a trusted **OAuth** platform (Google, Facebook...)
|
|
|
|
## Brute force
|
|
|
|
### Lack of Rate limit
|
|
|
|
Is there any limit on the number of codes that you can try, so you can just brute force it? Be careful with a possible "silent" rate limit, always try several codes and then the real one to confirm the vulnerability.
|
|
|
|
### Flow rate limit but no rate limit
|
|
|
|
In this case, there is a flow rate limit (you have to brute force it very slowly: 1 thread and some sleep before 2 tries) but no rate limit. So with enough time, you can be able to find the valid code.
|
|
|
|
### Re-send code and reset the limit
|
|
|
|
There is a rate limit but when you "resend the code" the same code is sent and the rate limit is reset. Then, you can brute force the code while you resend it so the rate limit is never reached.
|
|
|
|
### Client side rate limit bypass
|
|
|
|
{% content-ref url="rate-limit-bypass.md" %}
|
|
[rate-limit-bypass.md](rate-limit-bypass.md)
|
|
{% endcontent-ref %}
|
|
|
|
### Lack of rate limit in the user's account
|
|
|
|
Sometimes you can configure the 2FA for some actions inside your account (change mail, password...). However, even in cases where there is a rate limit when you tried to log in, there isn't any rate limit to protect actions inside the account.
|
|
|
|
### Lack of rate limit re-sending the code via SMS
|
|
|
|
You won't be able to bypass the 2FA but you will be able to waste the company's money.
|
|
|
|
### Infinite OTP regeneration
|
|
|
|
If you can **generate a new OTP infinite times**, the** OTP is simple enough** (4 numbers), and you can try up to 4 or 5 tokens per generated OTP, you can just try the same 4 or 5 tokens every time and generate OTPs until it matches the ones you are using.
|
|
|
|
## CSRF/Clickjacking
|
|
|
|
Check if there is a Cross Site Request Forgery (CSRF) or a Clickjacking vulnerability to disable the 2FA.
|
|
|
|
## Remember me functionality
|
|
|
|
### Guessable cookie
|
|
|
|
If the "remember me" functionality uses a new cookie with a guessable code, try to guess it.
|
|
|
|
### IP address
|
|
|
|
If the "remember me" functionality is attached to your IP address, you can try to figure out the IP address of the victim and impersonate it using the **X-Forwarded-For** header.
|
|
|
|
## Older versions
|
|
|
|
### Subdomains
|
|
|
|
If you can find some "testing" subdomains with the login functionality, they could be using old versions that don't support 2FA (so it is directly bypassed) or those endpoints could support a vulnerable version of the 2FA.
|
|
|
|
### APIs
|
|
|
|
If you find that the 2FA is using an API located under a /v\*/ directory (like "/v3/"), this probably means that there are older API endpoints that could be vulnerable to some kind of 2FA bypass.
|
|
|
|
## Previous sessions
|
|
|
|
When the 2FA is enabled, previous sessions created should be ended. This is because when a client has his account compromised he could want to protect it by activating the 2FA, but if the previous sessions aren't ended, this won't protect him.
|
|
|
|
## Improper access control to backup codes
|
|
|
|
Backup codes are generated immediately after 2FA is enabled and are available on a single request. After each subsequent call to the request, the codes can be regenerated or remain unchanged (static codes). If there are CORS misconfigurations/XSS vulnerabilities and other bugs that allow you to “pull” backup codes from the response request of the backup code endpoint, then the attacker could steal the codes and bypass 2FA if the username and password are known.
|
|
|
|
## Information Disclosure
|
|
|
|
If you notice some confidential information appear on the 2FA page that you didn't know previously (like the phone number), then this can be considered an information disclosure vulnerability.
|
|
|
|
## **Password-Reset == disable 2FA**
|
|
|
|
1. Create an Account and Turn On 2FA.
|
|
2. Logout from that account.
|
|
3. Now, Go to forget Password-Reset page.
|
|
4. Change your password.
|
|
5. Now try to log in.
|
|
6. If you are not asked to enter a 2FA code, You can report.
|
|
|
|
# References
|
|
|
|
{% embed url="https://medium.com/@iSecMax/two-factor-authentication-security-testing-and-possible-bypasses-f65650412b35" %}
|
|
|
|
{% embed url="https://azwi.medium.com/2-factor-authentication-bypass-3b2bbd907718" %}
|
|
|
|
|
|
<details>
|
|
|
|
<summary><strong>HackTricks in </strong><a href="https://twitter.com/carlospolopm"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch</strong></a> <strong>Wed - 18.30(UTC) 🎙️</strong> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
|
|
|
- Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
|
|
|
- Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
|
|
|
- Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
|
|
|
- **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
|
|
|
- **Share your hacking tricks by submitting PRs to the [hacktricks repo](https://github.com/carlospolop/hacktricks) and [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)**.
|
|
|
|
</details>
|
|
|
|
|