2FA simple bypass

To access the lab click on the following link:

Lab: 2FA simple bypass | Web Security Academy

This lab’s two-factor authentication can be bypassed. We already have a valid username and password, but do not have access to the user’s 2FA verification code. To solve the lab, we need to access Carlos’s account page.

• Your credentials: wiener:peter
• Victim’s credentials carlos:montoya

Click on “Access the lab” button to open the lab page.

Lab introduction

On the lab page, you will see the “My Account” option in the top right corner. Click on it to log in using the provided credentials.

Lab page

Enter the given credentials and click on “login”.

login using known credentials

As soon as we try to login it asks for the 4 digit security code. We can see the “email client” button on top of the page. Click on that to see the email.

2FA security

On Email client page we can see the security code provided is 0250.

security code received on mail

Let’s enter that security code and login.

login with security code

We are successfully logged in as wiener.

logged in as wiener

By observing the link after login we can see that the link is changed to my-account?id=wiener. This information can be useful in bypassing 2FA (Two-Factor Authentication) through URL parameter manipulation.

changed url after login

We have been provided with the victim’s username and password. So let’s login with the provided username and password.

Log in with victim’s credentials

Again it asks for the 4-digit security code. Observe the URL of this page, we can simply try to manipulate the URL to login.

2FA on victim’s account

Let’s manipulate the URL by adding my-account at the end of url. Booom!! We are logged in as carlos. We have successfully bypassed 2FA by manipulating url.

2FA Bypassed

Congratulations! The walkthrough of second authentication lab finishes here.

You can see walkthrough of Third lab by clicking the following link:

Password reset broken logic