skills.rest
inventashif
inventashifCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-mfa-bypass

Tests MFA and 2FA implementations for seven bypass patterns including OTP replay, workflow skips, and race conditions.

Updated Sep 6, 2026
Search Tags:#race condition#2fa#bug bounty#mfa bypass#account takeover#authentication testing#otp brute force
One-click install
npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-mfa-bypass-inventashif
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-mfa-bypass
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/hunt-mfa-bypass
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-mfa-bypass-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires aiohttp.

What problem does it solve? Security testers need a systematic way to probe multi-factor authentication implementations for weaknesses that lead to account takeover, but MFA bypass techniques are scattered across many distinct patterns that are easy to miss during an assessment. ## Core Features & Use Cases - Seven MFA Bypass Patterns: Covers missing MFA enforcement on sensitive endpoints, MFA-step skipping via direct navigation, OTP replay, OTP brute force without rate limits, race conditions on OTP validation, recovery-code disclosure, and backup factor downgrade. - Prefix Oracle Technique: Detects incremental OTP validation that leaks correctness digit-by-digit, collapsing a 10^6 brute force into roughly 60 guesses within a single session. - Chain Escalation Guidance: Maps MFA bypass primitives to account takeover chains involving cookie theft, password oracles, and missing step-up authentication. - Use Case: During an authorized bug bounty engagement, trace the login flow in Burp, capture the pre-MFA session cookie, and request /dashboard directly to confirm whether MFA is enforced server-side or only in the UI. ## Quick Start Ask the AI to test the target application's MFA flow for bypass patterns, starting with skipping the MFA step by accessing protected endpoints with the pre-MFA session.

Frequently Asked Questions about hunt-mfa-bypass

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for MFA bypass in a web application?▼

Start with workflow bypasses before brute force: log in with valid credentials to get a pre-MFA session, then directly request protected endpoints like /dashboard or /api/me. If the server returns user data without completing MFA, the check is client-side only, which is a Critical finding.

How to brute force a 6-digit OTP without rate limits?▼

Use ffuf with a wordlist from 000000 to 999999 against the OTP verification endpoint, throttled with -t 5 to avoid bans. First check for a prefix oracle, since incremental validation collapses the search to about 60 guesses within one session.

What is an OTP prefix oracle and how does it work?▼

A prefix oracle occurs when the server validates an OTP digit-by-digit instead of all-or-nothing, leaking correctness through differing responses. You keep the prefix that responds correctly, append digits 0-9, and repeat, reducing 10^6 attempts to roughly 10 per digit.

Can OTP race conditions be tested with two parallel requests?▼

No, two requests almost always resolve sequentially and produce false negatives. Use around 30 concurrent submissions of the same OTP, ideally via a single-packet attack with 20+ HTTP/2 streams in Turbo Intruder, to hit the check-then-use window.

When is an MFA bypass rated Critical versus High severity?▼

A standalone MFA bypass that requires the victim's password is typically High. It becomes Critical when chained with a password oracle or cookie theft, enabling account takeover without ever facing the OTP challenge, per the pre-severity triage gate.

Related Skills

Explore More Software Engineering Skills→
marcboggsmarcboggs

hunt-mfa-bypass

Tests MFA and 2FA implementations for seven bypass patterns during authorized security assessments.

Community
Intermediate
marcboggsmarcboggs

report-writing

Writes impact-first bug bounty reports for HackerOne, Bugcrowd, Intigriti, and Immunefi with CVSS scoring.

Community
Intermediate
Q16GQ16G
83

graybox-p0

Orchestrate gray-box testing by combining white-box candidate discovery with black-box request validation.

Community
Intermediate
wadvancedwadvanced
11

gate

Run consistency fixes and commit only when the status is CLEAN.

Official
Basic