Today I'll be teaching you how you can bypass two-factor authentication. You finally managed to get the password of your friend, coworker, or even Mr. Heck Aoy, and now when you log in to the site, you get a popup that says, "Hey, answer to two-factor authentication right now."

Well, that is a big problem, but as hackers, we have to find ways to overcome that. So one of the best ways is to just go ahead and hack into the phone so that you get the one-time password too.

The other way is to hack into the backend database to uncover that secret value which allows you to then add into your own authenticator, providing those one-time passwords for you. And before we get started, kids, remember hacking is illegal. Ask your mom for permissions first. So the first thing of

course is you need a hacker. So in this case, we have Mr. Hacker Law, who is going to be running the hack, teaching you exactly what's going on. Next up, you have a website. So in this case, we have a website that we're targeting, and of

course on the back end there is a database of records storing all this different information. So the information we're targeting in this case is called the secret value, and this secret value is a value that we can then use in our own mobile device or in our own

authenticator. We insert that value over here, and when we get a pop-up for the 2FA, we're able to place that value over into 2FA, allowing us to bypass the authentication. And yes, it is super cool, I know. And right in front of us, we have

col electronic and we are on a login page so in this case we have a target and of course you have been watching all of Mr. hacker's LA's videos and perhaps you know the password is 1 2 3 4 5 6 7 8

or the password is as Mr. hacker is very handsome so either of these two options you can try to inject them so in this case we have say hacker Loy at hacker.com and I can enter the password 1 2 3 4 5 6 7 8 I click log in guess

what we're able to log right in okay so what we want to do now is we can go ahead and set up the two-factor authentication so in this case there is a generation of a QR code in reality QR codes are just values that you can then

scan it from your phone so you have two options here one you take out your phone you scan this QR code to get some information from there or two what you can do is do a right click onto the image click save image as so in this case I'm going to save this as Hackle

Loy QR code.png click save I will replace this file and what I'll do now is go ahead and analyze the file using a tool so in this case we want to extract the value or information out of the QR code so I'm using in this example read

qr. Python and I'll go ahead and analyze the file that we have downloaded hit enter on that and let's go ahead and do a dot slash on this hit enter on that again and boom we're able to extract the value right here so we have the

following in this case we have the value of D4 IC CJ3 and so on and so forth and of course before the N which is the issuer of O wsp Juice Shop so now that we've extracted the value we can go ahead and click add and in this case we

can either scan a QR code or enter a setup key so let's go ahead and enter the setup key so in this case I'll call this hacker Loy hacked and I'll go ahead and enter the key right here as you can see here I've selected onto the account

name as well as the key I click add and boom we are done so what I can do now is go back over into the registration of the two Factor authentication so what we can do now is go ahead and enter the current password so in this case we're 1

through 3 4 5 6 7 8 as to current password or Mr hacker Loy could be using hacker Loy is very handsome and not a set of password too next up from the generated six digit PIN all I got to do right now is go ahead and enter 189 all right

followed by the following of 297 all right go ahead and enter that click save and boom we're done so now we have set up the two Factor authentication or configuration for it so to show the example of the validation being stored in a backend database in this case we're

using sqlite 3 and I go ahead and use sqlite 3 Target ju shop. sqlite H and on that and what I can do now is go ahead and query the tables within this database so you can go ahead and answer the following of say do table see answer

that and it shows you all the tables within the database and in this case, likely most likely the information is going to be stored under the users table so let's go ahead and query that so I can do the following: schema users and see what the schema is like. So in this case, 

we have ID, we have username, we have email and so on and so forth and the one that is most important for us as part of today's hack is top secret. So now what we can do is go ahead and query that so I can do this following: Select email

all right, from users all right where email equals in this case we have hackerloy and hackerloy.com, hit enter on that and this value over here is the same value as the one that we've extracted earlier when we were scanning

and extracting the value from the QR code image. You may see like why didn't I scan a QR code directly from my phone? Well, if I scan directly from my phone I wouldn't look like a hacker now if the website has a SQL injection vulnerability I can click under account, I click login and

what I can do now is enter say hackerloy and hacker.com but because of a SQL injection vulnerability what we are doing here is I can enter whatever password I want to which is not an actual password, it will still bring us and allow us to log into this user so

what I can do now is go ahead and click login but boom we get stopped, we get stopped by the two-factor authentication and we do not have the value. So what we need to do is to need to hack into the backend database to extract that value.

so that we can add it into our own authenticator. So what I've done here, I went to the top right corner of the browser and I've gone ahead and set up an Interceptor. So in this case, we're using Burp Suite as our Interceptor. And when I

go over into Burp Suite, you can see right here we're intercepting under the Proxy tab. And right here we have a specific request to 127.0.0.1:1117. Of course, in the real world, it will be a domain name. So in this case, I can do a right click

on this, can send over to say Repeater. And from Repeater, you can see right here with g/r product search. So I can enter say "apple" and I hit enter on that. When I send it over, we get some results back. So again, as you have understood earlier, it

is using a database on the back end. And of course, in return, whatever we search for, it is providing us those values back in JSON. And this specific query has a vulnerability. And as you can see here on the left, we have the payload. So we have

a union select from SQL life master. So we're trying to understand the schema, the tables, and all this different information behind the backend database. So I go ahead and click Send on this, and you can see right here, okay, we have some error messages. So this is a result of

ensuring that we fit into the column that was retrieved for us in order to get back those actual values. At the same time, if you see over here, we have SQL select star from products where name like, etc. This is the query that is being run by the application against the

backend database that we saw earlier so if you see on the left right now I have updated the payload a little more so we have unit select SQL 2 3 4 5 6 7 8 9 from SQLite master go ahead and click

Send on this and boom we are done so if I scroll down further especially past the first table that is providing us a list of products and all the different values of the products if you scroll down further over it it will be able to provide us all the different information

regarding the different tables within the database so in this case if I scroll down a little more you'll be able to see here we have create table addresses create table basket items create table baskets and so on so forth so the one that we're really interested in in this

case is going to be under the users right so in this case let's go ahead and go over into the users table so in this case we have user ID carts and complaints feedbacks so this gives us an idea about all the tables that we saw

earlier when we were directly querying from the database but that requires that we have access to the operating system so in this case let's go over into users all right so let's go ahead and search for that so right here this is the one that

we're targeting so we have create table users so same thing that we saw earlier so we have the password we have the email and of course the one that we're targeting in today's case is going to be top secret so you can see right here we

have a new set of payloads which is unit select email, password, user. So we are querying directly into the users table, so when I click Send on this, this gives us information again after we pass the first table of all these different products. Information if I scroll down

further we'll be able to see all this different users' information. So in this case we have like J1 2934 which is an admin account at J shop, and so on and so forth. So all these are different information that we are able to retrieve right now and

the one you're targeting in this case is going to be hacker Loy and hackerlaw.com. And we can see right here this is the value that we extracted earlier from the extraction of this value. I can go back over into, say, Google Authenticator and I can easily add this

as an additional value of time-based one-time password setup. So what I can do right now is go ahead and click onto plus, enter a setup key. And so right now what we'll do is enter an account name. So in this case, hacker Loy, and after that go ahead and

copy and paste a value right here once you're ready. Go ahead and click Add on this and it will generate all this value for us. So right here we have 08 9575, but let's give it a second more, get the new generation of six-digit pin. Let's enter

through this 48613. Right, go ahead and turn off Burp Suite in this case. I'll turn it off right now. I'll click on account, click log in, and go ahead and enter hackerlaw and hackerlaw.com, and then the password, or if you have the SQL injection payload

ready you can do the same whichever case it is it brings you over in two-factor authentication token so right now if I go back over into Android right 48613 go ahead and click log in just in time we are now in we have managed to hack into the account as a result of

breaking into the backend database that is storing all this two-factor authentication shared secret

How Hackers Bypass Two-Factor Authentication (2FA)?!

Loi Liang Yang

2단계 인증 우회 방법 소개 및 방법

비밀번호 획득 후 2단계 인증의 문제점에 대해 설명합니다.

일회용 비밀번호를 위해 휴대폰을 해킹할 것을 제안합니다.

인증자의 비밀값을 얻기 위해 백엔드 데이터베이스를 해킹하는 방법에 대해 설명합니다.

해커, 웹사이트, 목표 '비밀 값'이 있는 데이터베이스 등 시나리오를 소개합니다.

알려진 비밀번호로 로그인하는 방법을 설명합니다.

2단계 인증을 위한 QR 코드 생성을 표시합니다.

QR코드 이미지를 저장하고 도구(read_qr.py)를 사용하여 분석합니다.

QR코드에서 비밀값을 추출합니다.

추출한 비밀 값을 인증자에 추가합니다.

백엔드 데이터베이스에서 비밀 값에 액세스하기

추출된 비밀값을 사용하여 2단계 인증을 설정합니다.

sqlite3를 사용하여 데이터베이스를 쿼리하고 사용자 테이블을 찾습니다.

특정 이메일에 대한 사용자 테이블의 '일급 비밀' 값을 쿼리합니다.

휴대폰에서 QR 코드가 직접 스캔되지 않은 이유를 설명합니다.

SQL 인젝션을 통해 유효한 비밀번호 없이 로그인할 수 있는 시나리오에 대해 설명합니다.

2단계 인증 값을 얻기 위해 백엔드 데이터베이스를 해킹해야 한다는 점을 강조합니다.

버프 스위트를 사용하여 네트워크 요청을 가로채고 분석합니다.

요청을 가로채서 리피터로 보내는 것을 표시합니다.

데이터베이스 스키마에 액세스하기 위해 취약한 쿼리를 사용하는 방법에 대해 설명합니다.

데이터베이스에서 정보를 검색하기 위해 페이로드를 구체화합니다.

사용자 정보 및 일급 비밀 가치 검색

쿼리 결과를 표시하여 데이터베이스의 다양한 테이블을 표시합니다.

'사용자' 테이블에 초점을 맞춰 대상 정보를 찾습니다.

'사용자' 테이블 내에서 '일급 비밀' 열을 찾습니다.

새 페이로드를 사용하여 사용자 테이블에서 이메일, 비밀번호, 일급 비밀을 직접 쿼리합니다.

대상 사용자의 일급 비밀 값을 포함한 사용자 정보를 검색합니다.

인증자에 비밀값을 추가하고 로그인 성공하기

검색된 일급 비밀 값을 Google 인증서에 추가합니다.

Google 인증기에서 생성된 6자리 PIN을 가져옵니다.

획득한 PIN을 사용하여 로그인을 시도합니다.

2단계 인증 토큰을 제공한 후 로그인에 성공했습니다.

백엔드 데이터베이스에 액세스하여 해킹에 성공한 내용을 요약합니다.