Techniques for Bypassing Two-Factor Authentication Security

Hacker Loy successfully bypassed two-factor authentication by extracting secret values from the backend database.

Thank you! If you have any specific sentences or text that you'd like me to help with by bolding the key phrases, please share them, and I'll assist you right away.

Today I'll be teaching you how you can bypass two-factor authentication. You finally managed to get the password of your friend, coworker, or even Mr. Heck Aoy, and now when you log in to the site, you get a popup that says, "Hey, answer to two-factor authentication right now."

Well, that is a big problem, but as hackers, we have to find ways to overcome that. So one of the best ways is to just go ahead and hack into the phone so that you get the one-time password too.

The other way is to hack into the backend database to uncover that secret value which allows you to then add into your own authenticator, providing those one-time passwords for you. And before we get started, kids, remember hacking is illegal. Ask your mom for permissions first. So the first thing of

course is you need a hacker. So in this case, we have Mr. Hacker Law, who is going to be running the hack, teaching you exactly what's going on. Next up, you have a website. So in this case, we have a website that we're targeting, and of

course on the back end there is a database of records storing all this different information. So the information we're targeting in this case is called the secret value, and this secret value is a value that we can then use in our own mobile device or in our own

authenticator. We insert that value over here, and when we get a pop-up for the 2FA, we're able to place that value over into 2FA, allowing us to bypass the authentication. And yes, it is super cool, I know. And right in front of us, we have

col electronic and we are on a login page so in this case we have a target and of course you have been watching all of Mr. hacker's LA's videos and perhaps you know the password is 1 2 3 4 5 6 7 8

or the password is as Mr. hacker is very handsome so either of these two options you can try to inject them so in this case we have say hacker Loy at hacker.com and I can enter the password 1 2 3 4 5 6 7 8 I click log in guess

what we're able to log right in okay so what we want to do now is we can go ahead and set up the two-factor authentication so in this case there is a generation of a QR code in reality QR codes are just values that you can then

scan it from your phone so you have two options here one you take out your phone you scan this QR code to get some information from there or two what you can do is do a right click onto the image click save image as so in this case I'm going to save this as Hackle

Loy QR code.png click save I will replace this file and what I'll do now is go ahead and analyze the file using a tool so in this case we want to extract the value or information out of the QR code so I'm using in this example read

qr. Python and I'll go ahead and analyze the file that we have downloaded hit enter on that and let's go ahead and do a dot slash on this hit enter on that again and boom we're able to extract the value right here so we have the

following in this case we have the value of D4 IC CJ3 and so on and so forth and of course before the N which is the issuer of O wsp Juice Shop so now that we've extracted the value we can go ahead and click add and in this case we

can either scan a QR code or enter a setup key so let's go ahead and enter the setup key so in this case I'll call this hacker Loy hacked and I'll go ahead and enter the key right here as you can see here I've selected onto the account

name as well as the key I click add and boom we are done so what I can do now is go back over into the registration of the two Factor authentication so what we can do now is go ahead and enter the current password so in this case we're 1

through 3 4 5 6 7 8 as to current password or Mr hacker Loy could be using hacker Loy is very handsome and not a set of password too next up from the generated six digit PIN all I got to do right now is go ahead and enter 189 all right

followed by the following of 297 all right go ahead and enter that click save and boom we're done so now we have set up the two Factor authentication or configuration for it so to show the example of the validation being stored in a backend database in this case we're

using sqlite 3 and I go ahead and use sqlite 3 Target ju shop. sqlite H and on that and what I can do now is go ahead and query the tables within this database so you can go ahead and answer the following of say do table see answer

that and it shows you all the tables within the database and in this case, likely most likely the information is going to be stored under the users table so let's go ahead and query that so I can do the following: schema users and see what the schema is like. So in this case, 

we have ID, we have username, we have email and so on and so forth and the one that is most important for us as part of today's hack is top secret. So now what we can do is go ahead and query that so I can do this following: Select email

all right, from users all right where email equals in this case we have hackerloy and hackerloy.com, hit enter on that and this value over here is the same value as the one that we've extracted earlier when we were scanning

and extracting the value from the QR code image. You may see like why didn't I scan a QR code directly from my phone? Well, if I scan directly from my phone I wouldn't look like a hacker now if the website has a SQL injection vulnerability I can click under account, I click login and

what I can do now is enter say hackerloy and hacker.com but because of a SQL injection vulnerability what we are doing here is I can enter whatever password I want to which is not an actual password, it will still bring us and allow us to log into this user so

what I can do now is go ahead and click login but boom we get stopped, we get stopped by the two-factor authentication and we do not have the value. So what we need to do is to need to hack into the backend database to extract that value.

so that we can add it into our own authenticator. So what I've done here, I went to the top right corner of the browser and I've gone ahead and set up an Interceptor. So in this case, we're using Burp Suite as our Interceptor. And when I

go over into Burp Suite, you can see right here we're intercepting under the Proxy tab. And right here we have a specific request to 127.0.0.1:1117. Of course, in the real world, it will be a domain name. So in this case, I can do a right click

on this, can send over to say Repeater. And from Repeater, you can see right here with g/r product search. So I can enter say "apple" and I hit enter on that. When I send it over, we get some results back. So again, as you have understood earlier, it

is using a database on the back end. And of course, in return, whatever we search for, it is providing us those values back in JSON. And this specific query has a vulnerability. And as you can see here on the left, we have the payload. So we have

a union select from SQL life master. So we're trying to understand the schema, the tables, and all this different information behind the backend database. So I go ahead and click Send on this, and you can see right here, okay, we have some error messages. So this is a result of

ensuring that we fit into the column that was retrieved for us in order to get back those actual values. At the same time, if you see over here, we have SQL select star from products where name like, etc. This is the query that is being run by the application against the

backend database that we saw earlier so if you see on the left right now I have updated the payload a little more so we have unit select SQL 2 3 4 5 6 7 8 9 from SQLite master go ahead and click

Send on this and boom we are done so if I scroll down further especially past the first table that is providing us a list of products and all the different values of the products if you scroll down further over it it will be able to provide us all the different information

regarding the different tables within the database so in this case if I scroll down a little more you'll be able to see here we have create table addresses create table basket items create table baskets and so on so forth so the one that we're really interested in in this

case is going to be under the users right so in this case let's go ahead and go over into the users table so in this case we have user ID carts and complaints feedbacks so this gives us an idea about all the tables that we saw

earlier when we were directly querying from the database but that requires that we have access to the operating system so in this case let's go over into users all right so let's go ahead and search for that so right here this is the one that

we're targeting so we have create table users so same thing that we saw earlier so we have the password we have the email and of course the one that we're targeting in today's case is going to be top secret so you can see right here we

have a new set of payloads which is unit select email, password, user. So we are querying directly into the users table, so when I click Send on this, this gives us information again after we pass the first table of all these different products. Information if I scroll down

further we'll be able to see all this different users' information. So in this case we have like J1 2934 which is an admin account at J shop, and so on and so forth. So all these are different information that we are able to retrieve right now and

the one you're targeting in this case is going to be hacker Loy and hackerlaw.com. And we can see right here this is the value that we extracted earlier from the extraction of this value. I can go back over into, say, Google Authenticator and I can easily add this

as an additional value of time-based one-time password setup. So what I can do right now is go ahead and click onto plus, enter a setup key. And so right now what we'll do is enter an account name. So in this case, hacker Loy, and after that go ahead and

copy and paste a value right here once you're ready. Go ahead and click Add on this and it will generate all this value for us. So right here we have 08 9575, but let's give it a second more, get the new generation of six-digit pin. Let's enter

through this 48613. Right, go ahead and turn off Burp Suite in this case. I'll turn it off right now. I'll click on account, click log in, and go ahead and enter hackerlaw and hackerlaw.com, and then the password, or if you have the SQL injection payload

ready you can do the same whichever case it is it brings you over in two-factor authentication token so right now if I go back over into Android right 48613 go ahead and click log in just in time we are now in we have managed to hack into the account as a result of

breaking into the backend database that is storing all this two-factor authentication shared secret

How Hackers Bypass Two-Factor Authentication (2FA)?!

Loi Liang Yang

Introduction and Methods to Bypass Two-Factor Authentication

Explains the problem of two-factor authentication after obtaining a password.

Suggests hacking into the phone for the one-time password.

Describes hacking into the backend database to get the secret value for the authenticator.

Introduces the scenario: hacker, website, and database with the target 'secret value'.

Extracting the Secret Value from a QR Code

Illustrates logging in with a known password.

Shows the generation of a QR code for two-factor authentication.

Saves the QR code image and analyzes it using a tool (read_qr.py).

Extracts the secret value from the QR code.

Adds the extracted secret value to the authenticator.

Accessing the Secret Value from the Backend Database

Sets up two-factor authentication using the extracted secret value.

Uses sqlite3 to query the database and find the users table.

Queries the 'top secret' value from the users table for a specific email.

Explains why the QR code wasn't scanned directly from the phone.

Describes a scenario where SQL injection allows login without a valid password.

Highlights the need to hack into the backend database to get the two-factor authentication value.

Uses Burp Suite to intercept and analyze network requests.

Shows intercepting a request and sending it to Repeater.

Explains the use of a vulnerable query to access database schema.

Refines the payload to retrieve information from the database.

Retrieving User Information and Top Secret Value

Shows the results of the query, revealing various tables in the database.

Focuses on the 'users' table to find the target information.

Locates the 'top secret' column within the 'users' table.

Uses a new payload to directly query for email, password, and top secret from the users table.

Retrieves user information, including the target user's top secret value.

Adding the Secret Value to Authenticator and Successful Login

Adds the retrieved top secret value to Google Authenticator.

Obtains the generated six-digit PIN from Google Authenticator.

Attempts to log in using the obtained PIN.

Successfully logs in after providing the two-factor authentication token.

Summarizes the successful hack by accessing the backend database.