Multi-TOTP Authenticator
Summary: PortSwigger's BApp Store lists a Burp Suite extension called Multi-TOTP Authenticator, version 1.0.0, authored by Stephen Santilli and last updated 27 November 2025. The extension manages multiple time-based one-time passwords at once and inserts each TOTP into requests based on customizable match patterns, so testers can work against applications that protect different endpoints or accounts with separate MFA tokens.
What's compelling: The extension is third-party code, and PortSwigger states it makes no warranty about its quality or usefulness for any particular purpose - a caveat worth weighing before it handles live MFA tokens inside a testing workflow.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026