Web Application Account Compromise via 2FA Bypass

UpdatedJanuary 16, 2026

•2 min read•View as Markdown

Web Application Account Compromise via 2FA Bypass

Cyber Sekler

Comments

Join the discussion

No comments yet. Be the first to comment.

More from this blog

Password Reset Poisoning Leading to Account Takeover

Overview During a penetration test of a Web Applications API, I discovered a vulnerability in the password reset functionality that allowed an attacker to intercept reset tokens and take over user accounts. By manipulating a user-controllable field i...

Jan 16, 20262 min read

Password Reset Poisoning Leading to Account Takeover

Exposed .git Directory Leading to Source Code Disclosure and Hardcoded Credentials

During a web application assessment, I discovered an exposed .git directory that allowed me to download the application's entire source code. By extracting and analysing the git objects, I identified hardcoded credentials that granted admin-level acc...

Dec 16, 20252 min read

Exposed .git Directory Leading to Source Code Disclosure and Hardcoded Credentials

Broken Access Control Leading to Privilege Escalation

Overview During a web application penetration test, I identified a broken access control issue that allowed a low-privileged user to escalate their privileges to administrator. The issue was easy to identify and had a high impact, as it allowed full ...

May 20, 20252 min read

Broken Access Control Leading to Privilege Escalation

Unauthenticated SQL Injection Leading to Remote Command Execution in a Web Application

Overview During a black-box web application penetration test, I identified an unauthenticated SQL injection vulnerability that could be escalated to remote command execution. Although SQL injection vulnerabilities are less common today, this finding ...

Nov 16, 20242 min read

Unauthenticated SQL Injection Leading to Remote Command Execution in a Web Application

Cyber Sekler

7 posts

Overview

During a penetration test of a web application, I identified a flawed two-factor authentication implementation that could be bypassed using brute-force techniques. This finding demonstrates that poorly implemented two-factor authentication (2FA) can provide a false sense of security while remaining vulnerable to bypasses.

Discovery

While testing the 2FA flow, I observed that one-time codes were delivered to users via email. I noticed that a previously issued 2FA code remained valid far longer than expected. I was able to reuse a code that had been generated approximately one day earlier, which indicated that the code expiry window was either excessive or not enforced.

This observation prompted further testing of defensive controls commonly associated with 2FA implementations. I first tested whether repeated incorrect submissions would trigger an account lockout. I submitted several invalid codes, starting with three attempts and gradually increasing to five and beyond. No lockout behaviour was observed.

I then tested for rate limiting by sending increasing numbers of consecutive 2FA verification requests. Even after sending 50, 100, and then 150 requests in a short period, there was no indication that rate limiting was in place.

With no evidence of code expiry enforcement, lockout thresholds, or rate limiting, I moved on to assessing the strength and randomness of the generated 2FA codes. By reviewing multiple previously received codes, I observed that the values were numerically close to one another. This suggested insufficient randomness and a reduced effective keyspace.

To validate this, I submitted an invalid 2FA code and intercepted the verification request using Burp Suite. This request was then configured for brute-force testing using Burp Intruder.

The attack was performed by iterating through numeric values, starting from zero, rather than limiting the attack to the observed range. This was done deliberately to demonstrate the broader risk of the implementation rather than relying on optimisation.

During the attack, one response differed from the others, indicating a successful verification. This confirmed that the correct 2FA code had been identified through brute force, allowing authentication to complete successfully.

At this point, the 2FA control had been fully bypassed, and unauthorised access to the application was achieved.

Web Application Account Compromise via 2FA Bypass

Comments

More from this blog

Password Reset Poisoning Leading to Account Takeover

Exposed .git Directory Leading to Source Code Disclosure and Hardcoded Credentials

Broken Access Control Leading to Privilege Escalation

Unauthenticated SQL Injection Leading to Remote Command Execution in a Web Application

Overview

Objective

Discovery

Takeaway

Command Palette

Comments

More from this blog

Overview

Objective

Discovery

Takeaway