Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

"Lab: 2FA bypass using a brute-force attack" working correctly?

Philipp | Last updated: Mar 10, 2021 12:48PM UTC

Hello guys, can someone confirm that the lab "Lab: 2FA bypass using a brute-force attack" is working correctly? I've actually done everything exactly the same as stated in the solution, but with no luck. I've brute-forced all 10.000 possible mfa-code, but none worked. Thanks a lot in advance! Cheers, Phil

Ben, PortSwigger Agent | Last updated: Mar 11, 2021 08:30AM UTC

Hi Phil, I have just run through this lab and was able to solve it using the solution provided. A couple of obvious things to check would be - have you setup your macro correctly and are you using the correct request to perform the subsequent Intruder attack?

ta32 | Last updated: Apr 08, 2023 08:34AM UTC

"As the verification code will reset while you're running your attack, you may need to repeat this attack several times before you succeed. This is because the new code may be a number that your current Intruder attack has already attempted." Do we know how often the 2FA code resets? If it resets after every time you login it doesn't make sense to step through every possible number

Ben, PortSwigger Agent | Last updated: Apr 13, 2023 10:52AM UTC