> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-authentication-labs/lab-9.md).

# lab-9

## 2FA Bypass Using a Brute-Force Attack

**Difficulty:** Expert

### Lab Description

This lab's two-factor authentication is vulnerable to brute-forcing. You already have the victim's username and password but not their 2FA code. The code resets periodically, so the attack may need to be repeated if the code rotates during the attack.

**Victim's credentials:** `carlos:montoya`

**Objective:** Brute-force the 2FA code and access Carlos's account page.

### Solution

**Step 1 — Capture the authentication flow**

Log in as `carlos:montoya`, submit a wrong 2FA code (e.g. `1111`), and capture all requests in Burp. The four key requests are:

| Request        | Purpose                                                   |
| -------------- | --------------------------------------------------------- |
| `GET /login`   | Loads the login page; issues a new session and CSRF token |
| `POST /login`  | Submits username and password                             |
| `GET /login2`  | Loads the 2FA page after password verification            |
| `POST /login2` | Submits the 2FA code                                      |

**Step 2 — Why a macro is required**

The application issues a fresh session and CSRF token on every visit to `GET /login`. If Intruder reuses a single session across all 10,000 attempts, it will be invalidated quickly. A **Burp macro** is needed to automatically re-run the login sequence before each `POST /login2` attempt, keeping the session valid throughout the attack.

**Step 3 — Configure the session-handling macro**

In Burp, go to **Settings → Sessions → Session Handling Rules → Add**. Add a rule that runs a macro before each Intruder request. Configure the macro to execute these three requests in order:

1. `GET /login`
2. `POST /login` (with `carlos:montoya` credentials)
3. `GET /login2`

Test the macro — it should produce responses of `200`, `302`, `200` in sequence, confirming it successfully authenticates and lands on the 2FA page each time.

Set the rule scope to apply to **Intruder** only.

**Step 4 — Brute-force the 2FA code**

Send `POST /login2` to Intruder. Set the OTP/code field as the payload position:

```
mfa-code=§0000§
```

Configure the payload as numbers from `0` to `9999`:

* **Min/Max integer digits:** `4`
* **Max fraction digits:** `0`

This generates every possible 4-digit code from `0000` to `9999`.

Start the attack. For each attempt, the macro re-authenticates as `carlos` before submitting the code, keeping the session fresh.

**Step 5 — Use the valid session**

When a `302` response appears in the results, right-click it and select **Show response in browser**. Open the URL — Carlos's account page loads.

> **Note:** The 2FA code resets periodically. If the attack completes without finding a `302`, the code may have rotated mid-attack to a number already tested. Simply restart the attack.

### Conclusion

The 2FA code was only 4 digits, giving 10,000 possible values with no lockout after incorrect attempts. A Burp macro automated the re-authentication needed to keep the session valid across the full brute-force run, making exhaustive enumeration of the code space practical.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-authentication-labs/lab-9.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.