2FA Broken Logic

🎯 Objective

Exploit a broken 2FA flow to log in as carlos starting from a valid session for wiener:peter.

🧭 Scope / Setup

• Tooling: Burp Suite (HTTP history, Repeater, Intruder)
• Accounts: wiener:peter (known), target to impersonate: carlos

🔎 Steps

1. Log in as wiener:peter. Capture POST /login2 containing the username parameter.
2. Log out.
3. Send GET /login2 to Repeater and change the account to carlos to trigger a 2FA code for Carlos.
4. Log back in as wiener:peter and submit any 2FA code; send POST /login2 to Intruder.
5. Set verify=carlos and brute‑force the numeric OTP.
6. Identify the 302 redirect among 200s → open in browser → authenticated as Carlos.

🧪 Why This Works

• 2FA generation and verification are decoupled from the authenticated user session.
• Lack of binding between OTP and the initiating user enables account pivot.

✅ Outcome

• Successful account takeover of Carlos due to flawed 2FA validation/binding.

🛡️ Mitigations

• Bind OTP to user and session; include nonce tied to login flow.
• Rate‑limit and lockout after repeated failures; monitor anomalies.
• Use short‑lived OTP with strict server‑side state checks.

📝 Notes

• Always verify OTP consumption is scoped to the original authentication transaction.