Lab: 2FA bypass using a brute-force attack
Summary: PortSwigger's lab demonstrates that a two-factor authentication implementation can be defeated by brute-forcing the 2FA verification code, using credentials for the victim account carlos:montoya. Because the verification code resets during the attack, the lab notes the brute-force may need to be repeated several times, and it directs users to combine Burp macros with Burp Intruder or use the Turbo Intruder extension.
Key Takeaway: A 2FA code that can be guessed through repeated attempts is only as strong as the rate limiting and lockout behind it, so a valid password alone can be enough to reach an account.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026