2FA Testing Tips for Bug Bounty Hunters

Introduction
Two-Factor Authentication (2FA) adds a critical security layer to applications, but implementation flaws can lead to bypass vulnerabilities. Below are systematic techniques for bug bounty hunters to test 2FA robustness.

2FA Bypass and Manipulation Techniques

1. Status Code Changes
   Alter response/status codes (e.g., 403 ➜ 200) during verification.
2. Brute-Force OTP
   Test OTP attempts without rate-limiting.
3. OTP Reuse
   Check if used OTPs remain valid.
4. Cross-Account Token Test
   Use one account’s OTP for another.
5. Direct Dashboard Access
   Access the dashboard URL directly or spoof headers.
6. Search for Exposed OTPs
   Check server responses/JavaScript files using tools like Burp Suite.
7. CSRF & Clickjacking
   Test if 2FA can be disabled via CSRF or clickjacking.
8. Session Persistence
   Confirm 2FA logs out all active sessions.
9. OAuth Bypass
   Investigate OAuth flows bypassing 2FA.
10. Disable 2FA Without Verification
    Attempt disabling 2FA without valid OTP.
11. Password Reset Check
    Test “Forgot Password” flows to bypass 2FA.
12. Test Default OTPs
    Submit 000000 or similar default codes.
13. Request Manipulation
    Modify JSON parameters like:
    {"otprequired": false}

14. OpenID Misconfigurations
    Assess OpenID flows for bypass vulnerabilities.
15. OTP Expiry Validation
    Check if OTPs remain valid beyond expected times.
16. Backup Code Abuse
    Analyze backup code generation for flaws.
17. Sensitive Info Exposure
    Verify if 2FA pages leak emails or phone numbers.
18. Account Denial of Service (DoS)
    Abuse 2FA to lock target accounts.
19. Authenticated Actions Without 2FA
    Test actions like profile updates or API token generation without solving 2FA.
20. Bulk OTP Testing
    Send multiple OTPs in a JSON payload:
    {"code": ["1234", "5678", "9999"]}

21. Backup Code Misuse
    Explore unintended backup code generation or use.

Conclusion

2FA is critical for securing accounts, but improper implementation introduces bypass risks. By systematically testing for these vulnerabilities, bug bounty hunters can identify and report 2FA flaws, enhancing application security.

Tip: Automate repetitive tests and validate edge cases using tools like Burp Suite and manual manipulation techniques.