2FA bypass through flow and response manipulation

Multi-factor is often bolted on and skippable. Try requesting the post-2FA resource directly after step one, and manipulating the verification response.

POST /2fa/verify HTTP/1.1
{"otp":"000000"}
-> if response is {"success":false}, resend as {"success":true} where the client trusts it

Also probe the weaker paths.

# brute OTP if no rate limit, or abuse backup codes with low entropy
for i in $(seq -w 0 999999); do try_otp $i; done

Pro note: the highest-yield checks are: does the session become fully authenticated before OTP, can you reuse a code, is there a rate limit, and are backup codes short or sequential. Remember-me cookies frequently bypass 2FA entirely and may be forgeable.