Two Factor Authentication(2FA) Bypass Using Brute-Force Attack

During video we see how a weak protection against brute force attacks allows an attacker to automate a multi-step authentication process and successfully brute force verification code to bypass 2 factor authentication and log into the victim account.
Web Security Academy | Lab: 2FA bypass using a brute-force attack
portswigger.net/web-security/...
NOTE: This video is made ONLY for educational purposes and to help developers and security researchers to enhance their security knowledge. Therefore, allowing them to remediate potential vulnerabilities in their OWN applications.
Twitter: / tracethecode

[@ahmedabualkass390]

The time is right. When the OTP is six digits long, it will not prevent the final cut of the exam in case of selection due to a challenge. If the OTP is not released within 60 seconds, the OTP will expire.

[@allanamalsloveit]

You are amazing, we support you❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️

[@MafiMartins-cw5tv]

Thanks for teaching and giving us the ideal are amazing. I am really happy to be here thanks again 🙏🙌🧐✊

[@bjtaudio]

That will not work for most sites, as 1 the 4 digit usually 6 digits code keeps changing, often one-time codes and time limited, 2 after several failed attempts the account is locked, 3 often a secure app is used, 4 the system alerts the account holder of a login from a new device. 5 behavior checks, to see if its a automated attack.

[@ayman2796]

Good job Bro, What is the solution when the reaction of the website is different like that "attempts of enter the pin are limited in three time then it lock"?

[@charlotte8840]

Thanks for the tutorial! Can limiting the max. no. of One-time password (OTP) attempts and/or minimizing the time limit for each OTP entry help to prevent Brute-Force Attack?

[@thumpertorque_]

When you log into someone's account does it change their original password?

[@studiospan6426]

So basically this attack works on requsting a new otp from the server then trying that otp and hope that our combination of generated and payload otp somehow matches . Isn't this , really difficult and completely based on luck i mean yeah we can increase the speed by making our own code in nodejs or some other languages which are very very fast when it comes to webscraping but still the odds are very very high thay we will get the code i am not sure if any website will be willing to pay for this bug . Please correct me if am wrong 🙏

[@keithbow1779]

Thanks for such a detailed explanation.

[@TraceTheCode]

You are welcome!

[@shvraj883]

How I want see an otp send by server

[@Manoj-sy9ky]

Hi dude. My Facebook account Two factor authentication code didn't come.any solution pls

[@weird9890]

so 0167 was the code or something else?

[@khalidzahri1]

Could it bypass 2fa ebay ??

[@cypher875]

I got a very less secure app, which allows unlimited OTP tries .. in 5 mins then we just have to resend the otp is it possible to crack it ?

[@gamegunner9079]

Very detailed explanation Sir, many thanks

[@TraceTheCode]

Thanks and welcome!

[@gamegunner9079]

@@TraceTheCode I tried this sir but it was running for whole night and finally crashed my vm 😂

[@TraceTheCode]

Sorry to hear that! But it shouldn't take more than a few mins!

[@gamegunner9079]

@@TraceTheCode are you using it in VM? Ran it as 1 concurrent connection too but still same,will turbo intruder fasten up the process?

[@TraceTheCode]

yeah, concurrent Request must be 1. Using Turbo Intruder shouldn't make much difference.

[@nikitabiddle7344]

how to do this with andriod and windows

[@fokshand4950]

Can you make viedo bypass application not page

[@roseoliver1955]

Pls I need an answer

[@StanBodnar]

well done bro

[@romogomu6726]

Thankyou

[@tauruxx1893]

Can I use that to force the 2fa on a instagram account?

[@abdulhalim747]

Yes you can anywhere but remember use in legal

[@obiokoyenelson3760]

Will the website request a new otp each time the macro is run?

[@purvashgangolli5968]

I guess no, because after a particular single request from the browser the burp suite will virtually handle the request, so for the code which was sent by the original server for that will automate the task using macro.

[@the.jhantoo]

Is Work on My Jio ?

[@csh4992]

Why can my macro only add one request

[@TraceTheCode]

Maybe you forgot to hold the CTRL key while selecting the requests.

[@thanthtooaung2979]

How can we know the correct one is the first one??

[@doshamitv5020]

possible to bypass GOOGLE 2FA wiTh this?

[@jayskipesentertainment4738]

Have you tried it..?

[@doshamitv5020]

@@jayskipesentertainment4738 forget u can't bypass google 2fa that easy

[@Violocto]

Perfect 👍

[@TraceTheCode]

Cheers!

[@thanhnhannguyen1910]

could it by pass 2fa paypal bro?

[@bassxfunky2367]

Probably not because the code of 2fa will change afther 1 mins or 2 so i bet u cant find the right code in that time

[@Ayu_Chandravanshi]

@@bassxfunky2367 but if luck loves you, you can 😂

[@ahmedabualkass390]

​@@Ayu_Chandravanshihow ❤

[@cryptoearners4487]

I can't understand what's this... How can I by pass a gmil 2fa or what's app code ???

[@drewcurry2882]

The basic flaw: it assumes the required code does not change. Use an authenticator tool, with 6-digits that change every 30-seconds, with a 3-mistakes-results in a 5-minute cooldown, and you will need a quantum computer to try to break that puppy.

[@tajadavis]

Does this work for Snapchat Accounts?

[@kabita6936]

Does it work ?

[@saikirangoud118]

brilliant

[@DickmanYT]

do u need premium burl for this?

[@boomergaming4174]

Does it work for every 2FA? like Fcebook?

[@kiiturii]

bruh no lmao, huge companies will have high security especially for 2fa.

[@ANAS-ty6rn]

what about roblox LMAO @@kiiturii