Apprentice
← back to room
Auth Abuse

2FA Bypass

Scenario

After password login, users must enter a one-time code—unless they know a shortcut URL. An internal skip endpoint completes login without verifying the code. Access the protected area as victim without the OTP.

Your approach

  1. Log in as victim with the provided password to reach the OTP step.
  2. Browse or fuzz auth paths for a skip or bypass route.
  3. GET the skip endpoint while the partial session is active.
  4. Confirm you reach the authenticated area and see the bypass flag.
  5. Submit the 2FA skip flag.
Login as victim/victim. OTP is 111111 — but look for a hidden skip endpoint under /labs/auth/2fa/.