HACKING PROJECT · cloud · Advanced
2FA / MFA Bypass Research Lab
Reproduce and analyze modern MFA bypass techniques in a controlled lab to quantify factor resilience and build detections for each.
Organizations widely assume MFA is a silver bullet, yet attackers routinely defeat it via phishing proxies, push-bombing, SIM-swap, OTP interception, session-token theft, and recovery-flow abuse. Defenders lack a safe, controlled environment to reproduce these bypasses, measure which factor types resist them, and validate detection logic. Without hands-on replication, blue teams under-estimate real MFA risk.
**What you'll build**
Stand up an isolated lab hosting a vulnerable authentication app supporting TOTP, SMS OTP, and push MFA, then reproduce documented bypass classes: adversary-in-the-middle (AiTM) reverse-proxy phishing, MFA fatigue, OTP replay, and cookie/session hijack. Instrument each attack with detection telemetry and evaluate phishing-resistant FIDO2/WebAuthn as the mitigating control, producing a comparative resilience matrix.
**Objective** — Reproduce and analyze modern MFA bypass techniques in a controlled lab to quantify factor resilience and build detections for each.
**Expected outcome** — An isolated research lab, documented reproductions of each bypass class with telemetry, detection rules, and a factor-resilience comparison report recommending phishing-resistant MFA.
**Difficulty** — Advanced — requires deep auth-protocol knowledge, AiTM proxy setup, and safe adversarial replication with detection instrumentation.
**Primary category** — IAM; Secondary = Penetration Testing, Detection Engineering, Security Research
**Security domains** — Primary = Security Research; Secondary = Red Team, Blue Team, IAM, Purple Team
**Technical focus** — TOTP/HOTP internals, WebAuthn/FIDO2, AiTM reverse-proxy phishing, session-cookie theft, push-fatigue abuse, SIM-swap analysis, OTP replay, detection engineering, OAuth/OIDC flows
**Core technologies** — Languages: Python, JavaScript; Frameworks/Libraries: Flask/Node auth app, pyotp, WebAuthn libraries; Security Tools: Evilginx/Muraena (AiTM, lab-only), Burp Suite, mitmproxy, Sliver for token handling; Cloud/Infra: isolated VLAN/Docker lab, VPN-gated; AI/Data: log analytics; Databases: Redis (sessions), PostgreSQL (accounts)
**Where it's valued** — Finance, SaaS, identity providers, enterprise IT, MSSPs, security consulting
**Careers it builds toward** — IAM Security Engineer, Red Team Operator, Security Researcher, Penetration Tester, Detection Engineer
**Framework alignment**
• MITRE ATT&CK: Phishing (T1566), Adversary-in-the-Middle (T1557), Steal Web Session Cookie (T1539), Multi-Factor Authentication Request Generation (T1621), Steal Application Access Token (T1528)
• NIST CSF 2.0: Identify (ID.RA), Protect (PR.AA authentication), Detect (DE.CM), Respond (RS.AN)
• OWASP: A07 Identification & Authentication Failures; API2 Broken Authentication
• CIS Controls v8: 6 Access Control Management, 5 Account Management, 13 Network Monitoring