Techniques for Bypassing Two-Factor Authentication Security

Hacker Loy successfully bypassed two-factor authentication by extracting secret values from the backend database.

Thank you! If you have any specific sentences or text that you'd like me to help with by bolding the key phrases, please share them, and I'll assist you right away.

How Hackers Bypass Two-Factor Authentication (2FA)?!

Loi Liang Yang

Introduction and Methods to Bypass Two-Factor Authentication

Explains the problem of two-factor authentication after obtaining a password.

Suggests hacking into the phone for the one-time password.

Describes hacking into the backend database to get the secret value for the authenticator.

Introduces the scenario: hacker, website, and database with the target 'secret value'.

Extracting the Secret Value from a QR Code

Illustrates logging in with a known password.

Shows the generation of a QR code for two-factor authentication.

Saves the QR code image and analyzes it using a tool (read_qr.py).

Extracts the secret value from the QR code.

Adds the extracted secret value to the authenticator.

Accessing the Secret Value from the Backend Database

Sets up two-factor authentication using the extracted secret value.

Uses sqlite3 to query the database and find the users table.

Queries the 'top secret' value from the users table for a specific email.

Explains why the QR code wasn't scanned directly from the phone.

Describes a scenario where SQL injection allows login without a valid password.

Highlights the need to hack into the backend database to get the two-factor authentication value.

Uses Burp Suite to intercept and analyze network requests.

Shows intercepting a request and sending it to Repeater.

Explains the use of a vulnerable query to access database schema.

Refines the payload to retrieve information from the database.

Retrieving User Information and Top Secret Value

Shows the results of the query, revealing various tables in the database.

Focuses on the 'users' table to find the target information.

Locates the 'top secret' column within the 'users' table.

Uses a new payload to directly query for email, password, and top secret from the users table.

Retrieves user information, including the target user's top secret value.

Adding the Secret Value to Authenticator and Successful Login

Adds the retrieved top secret value to Google Authenticator.

Obtains the generated six-digit PIN from Google Authenticator.

Attempts to log in using the obtained PIN.

Successfully logs in after providing the two-factor authentication token.

Summarizes the successful hack by accessing the backend database.