> For the complete documentation index, see [llms.txt](https://kruknight.gitbook.io/daemon-of-hacking/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kruknight.gitbook.io/daemon-of-hacking/writeups/portswigger-labs/authentication/2fa-simple-bypass.md).
# 2FA simple bypass
## Lab description
## Walkthrough
### **Step 1: Login to your account**
Use the given credentials `wiener:peter` to log in. Once you enter the correct username and password, the application redirects you to a page asking for a 2FA code.
### **Step 2: Bypass the 2FA mechanism**
After entering the correct One-Time Password (OTP) for the `wiener` account, you gain full access to your account. However, our goal is to bypass the 2FA for the victim's account (`carlos:montoya`).
### **Step 3: Exploit the 2FA bypass vulnerability**
Log in using the victim's credentials `carlos:montoya`. Instead of entering the OTP, manually navigate to the `/my-account` page by modifying the URL in your browser. This will bypass the 2FA mechanism.
For example:
* Replace the 2FA page URL (`/login2`) with `/my-account`.
### **Step 4: Verify the exploit**
After modifying the URL, you are successfully logged into Carlos's account without needing to provide the OTP. This confirms the 2FA bypass vulnerability.
