Two Factor Authentication(2FA) Bypass Using Brute-Force Attack

During video we see how a weak protection against brute force attacks allows an attacker to automate a multi-step authentication process and successfully brute force verification code to bypass 2 factor authentication and log into the victim account.

Web Security Academy | Lab: 2FA bypass using a brute-force attack

NOTE: This video is made ONLY for educational purposes and to help developers and security researchers to enhance their security knowledge. Therefore, allowing them to remediate potential vulnerabilities in their OWN applications.

[ahmedabualkass]

The time is right. When the OTP is six digits long, it will not prevent the final cut of the exam in case of selection due to a challenge. If the OTP is not released within 60 seconds, the OTP will expire.

[bjtaudio]

That will not work for most sites, as 1 the 4 digit usually 6 digits code keeps changing, often one-time codes and time limited, 2 after several failed attempts the account is locked, 3 often a secure app is used, 4 the system alerts the account holder of a login from a new device. 5 behavior checks, to see if its a automated attack.

[drewcurry]

The basic flaw: it assumes the required code does not change. Use an authenticator tool, with 6-digits that change every 30-seconds, with a 3-mistakes-results in a 5-minute cooldown, and you will need a quantum computer to try to break that puppy.

[gamegunner]

Very detailed explanation Sir, many thanks

[allanamalsloveit]

You are amazing, we support you❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️❤️

[MafiMartins-cwtv]

Thanks for teaching and giving us the ideal are amazing. I am really happy to be here thanks again 🙏🙌🧐✊

[tauruxx]

Can I use that to force the 2fa on a instagram account?

[ayman]

Good job Bro, What is the solution when the reaction of the website is different like that "attempts of enter the pin are limited in three time then it lock"?

[charlotte]

Thanks for the tutorial! Can limiting the max. no. of One-time password (OTP) attempts and/or minimizing the time limit for each OTP entry help to prevent Brute-Force Attack?

[Manoj-syky]

Hi dude.
My Facebook account Two factor authentication code didn't come.any solution pls

[weird]

so 0167 was the code or something else?

[keithbow]

Thanks for such a detailed explanation.

[thumpertorque_]

When you log into someone's account does it change their original password?

[obiokoyenelson]

Will the website request a new otp each time the macro is run?

[doshamitv]

possible to bypass GOOGLE 2FA wiTh this?

[cypher]

I got a very less secure app, which allows unlimited OTP tries .. in 5 mins then we just have to resend the otp is it possible to crack it ?

[nikitabiddle]

how to do this with andriod and windows

[studiospan]

So basically this attack works on requsting a new otp from the server then trying that otp and hope that our combination of generated and payload otp somehow matches . Isn't this, really difficult and completely based on luck i mean yeah we can increase the speed by making our own code in nodejs or some other languages which are very very fast when it comes to webscraping but still the odds are very very high thay we will get the code i am not sure if any website will be willing to pay for this bug . Please correct me if am wrong 🙏

[thanthtooaung]

How can we know the correct one is the first one??

[fokshand]

Can you make viedo bypass application not page