Vulnerability Assessment of Multi-Factor Authentication Systems

Built a Flask-based web application integrating three MFA mechanisms: TOTP via PyOTP and QR code provisioning, Email OTP via Gmail SMTP, and simulated Push MFA with approve/deny prompts. Development environment used macOS (host) and Kali Linux in VMware Fusion for penetration testing.

Configured Burp Suite with FoxyProxy to intercept HTTP traffic during TOTP provisioning. The provisioning URI containing the base32 secret (transmitted in plaintext over HTTP) was captured. The intercepted secret was used with Oathtool (oathtool --totp -b <secret>) to generate valid OTPs indefinitely, completely bypassing MFA.

Developed a Python brute-force script using the Requests library to systematically attempt all 1,000,000 six-digit OTP combinations against the email verification endpoint. With no rate-limiting or account lockout, the correct OTP (988102) was found after 4,384 seconds (~1.2 hours) with 988,102 attempts.

Developed a Python spam script sending approximately 60 push approval requests per minute to the /spam-push endpoint. Simulated trials confirmed that repeated prompts induced users to approve requests out of frustration - replicating the MFA fatigue technique used in the 2022 Uber breach.

Each attack was evaluated against a defined adversary model (network attacker, automated attacker, social engineer) and assessed for real-world applicability. Findings were mapped to NIST SP 800-63B and OWASP Authentication Cheat Sheet standards.

TOTP provisioning URI transmitted in plaintext over HTTP. Secret intercepted via Burp Suite allowed indefinite generation of valid OTPs using Oathtool. A single intercepted secret permanently compromises the account. Real-world likelihood: Medium (affects misconfigured or development systems lacking TLS).

Six-digit email OTP (1,000,000 keyspace) successfully brute-forced using a Python Requests script in the absence of rate-limiting. Correct OTP found after 988,102 attempts in approximately 1.2 hours. With greater computational resources, the attack would be significantly faster.

Spam script generated ~60 push requests per minute. Simulated users reported difficulty distinguishing legitimate requests and a tendency to approve after repeated prompts. Replicates the MFA fatigue technique documented in the Uber 2022 breach. Real-world applicability: High.

Session tokens were not rotated after successful MFA completion, enabling session fixation attacks. Demonstrated via Burp Suite session cookie replay granting dashboard access without re-authentication.

Different error messages were returned for invalid usernames versus invalid passwords, enabling attacker enumeration of valid accounts prior to MFA bypass attempts.

Login POST requests transmitted username, password, and OTP in plaintext over HTTP. Captured via Burp Suite. Mitigated in production by enforcing HTTPS/TLS.