How I Bypassed 2FA and Earned My First Bounty $$$

Hacker Summary:

Two-Factor Authentication (2FA) is often seen as a strong defense against unauthorized access. But what if a small oversight could turn this shield into a vulnerability? Here’s the story of how I discovered a 2FA bypass in a private bug bounty program on HackerOne, leading to my first bounty — a $325 reward.

The Discovery:

I was determined to test every function the program had to offer. As I went through the process, I found a bunch of low-severity (P4) bugs. While I reported them, I knew they would probably get marked as duplicates or informational. Not one to give up easily, I decided to dig deeper into the program, hoping to find something more impactful.

The program used 2FA via an authenticator application. The authenticator generated a rotating 2FA code every 30 seconds, making rate-limiting attacks ineffective. Typically, rate-limit issues are easier to exploit with SMS OTPs, but with the rotating code in an authenticator app, there wasn’t much I could do.

Then, something caught my eye — another 2FA method: backup codes. After enabling 2FA, the program provided users with eight backup codes to download and use as a fallback 2FA option. Each backup code was a simple 6-digit number, and here’s where the opportunity arose.