> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/authentication/broken-2fa-logic.md).
# 有缺陷的 2FA 逻辑
有缺陷的 2FA 逻辑，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 2FA 逻辑漏洞
该应用引入了双因素认证：/ 在登录名/密码之后，会 **2FA 代码** 由……发送 **email**。/ 我们有：
* 我们的凭据： `wiener:peter`
* 受害者的用户名： `carlos`
访问 **邮件服务器** 用于接收 2FA 代码
#### 观察到的操作
1. 在第一次登录步骤之后，应用会通过电子邮件发送 2FA 代码。
2. 第二步（`/login2`）会检查此代码。
3. 2FA 适用的用户通过……确定 **`verify`** cookie。
第二步请求示例：
```http
GET /login2 HTTP/2
Host: 0a7500ab0376700f81a18e2c00f200a8.web-security-academy.net
Cookie: session=cNFHPofUz1wxXQpsZZN7yIiKQklG1Ygd; verify=carlos
```
在这里，我们强制将 `verify` cookie 设为 `carlos` ，使 2FA 检查在受害者的账户上进行。
#### 暴力破解 2FA 代码
1. 2FA 验证请求被发送到 **Intruder** （或等价项），方法是针对包含以下内容的请求：
```bash
mfa-code=XXXXX
```
* 该 **载荷** 被配置为测试代码的所有可能组合，从 `0000` 更改为 `9999` （即 10,000 个值）。
我们使用 cookie：
```bash
verify=carlos
```
* 以便所有代码测试都在……的账户上执行 **carlos**.
* 在设置中，会向响应添加一个\*\*过滤条件\*\*，以忽略包含以下消息的响应：
* `安全码错误`
1. 我们正在发起暴力攻击。
2. 在这些响应中，我们找到了一个不再包含错误消息且返回 \*\*HTTP 302 状态码\*\*（重定向）的响应。/ → 这个响应对应于 **2FA 代码正确** 代表 **carlos**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/authentication/broken-2fa-logic.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
