I want to use a commercial, automated tool but it cannot login successfully because the website requires a two factor authentication process using SMS. For testing, the SMS message is sent to another website, though in normal situations the SMS is sent to a mobile phone.
I clicked many buttons in target site. After that I scanned the site using Burp Suite Pro. However, most of the results that I get are false positives because site gives different responses. For example, the first response is an input error, and the second response is a timeout error. For this reason, the tool looks the responses and reports false positive results.
How can I successfully pentest site with two factor authentication ?