Google Authenticator
Summary: PortSwigger's BApp Store lists a third-party Burp Suite extension called Google Authenticator, authored by Alexandre Teyar of Aegis Cyber, that turns Burp into a TOTP client generating and applying current 2FA codes to HTTP requests in real time. Version 1.2.0 was last updated 05 September 2025 and is rated low for estimated system impact, with PortSwigger stating it makes no warranty about third-party extensions' quality or usefulness.
What's compelling: The tool exists so testers can run automated scans against applications protected by Google 2FA without manually pulling codes from a phone - the same capability an attacker with stolen credentials and a seed would want, which puts the burden on how well your second factor resists automated replay.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026