What problem does it solve? Multi-factor authentication implementations often fail silently: pre-MFA sessions may access protected resources, consumed recovery codes may be accepted twice, or sensitive actions may skip step-up verification. This Skill provides a structured, evidence-gated methodology to verify that MFA is actually enforced server-side on every endpoint. ## Core Features & Use Cases - MFA Enforcement Verification: Confirms that pre-MFA sessions and tokens are rejected by endpoints that should require a completed MFA challenge. - One-Time Code Binding Checks: Validates that consumed OTPs, TOTPs, and backup recovery codes are invalidated and bound to the correct account without brute-forcing codes. - Step-Up Authentication Testing: Checks whether sensitive operations (password, email, or fund changes) trigger an additional authentication challenge. - Use Case: During an authorized web application assessment, you test whether a session captured before MFA completion can directly access the account dashboard, and whether a used recovery code is accepted a second time. ## Quick Start Ask the agent to run the hunt-mfa-flow route against your authorized test accounts to verify MFA enforcement, recovery code invalidation, and step-up authentication on sensitive endpoints.
