I want to use a commercial, automated tool but it cannot login successfully because the website requires a two factor authentication process using SMS. For testing, the SMS message is sent to another website, though in normal situations the SMS is sent to a mobile phone.

I clicked many buttons in target site. After that I scanned the site using Burp Suite Pro. However, most of the results that I get are false positives because site gives different responses. For example, the first response is an input error, and the second response is a timeout error. For this reason, the tool looks the responses and reports false positive results.

How can I successfully pentest site with two factor authentication ?

  • Could you edit your second paragraph? I completely don't understand what you are saying. It sounds like you mean you clicked a lot of buttons, or perhaps you clicked a button called 'a lot'. It's also not clear why you are getting different responses - do you get different responses for the same input in the same location or for different buttons in different places with different inputs? – atk Dec 17 '13 at 16:30
  • I get different response for the same input in the same location. – dgn Dec 17 '13 at 22:05
  • I clicked many buttons in pages for make history in Burp Suite Pro – dgn Dec 17 '13 at 22:06

It sounds like you are asking how to get an automated tool to log into a site that offers two factor authentication. With the limited info you provided, there are four approaches that come to mind.

  1. use the tool's manual spidering facility. Many automated tools offer the ability to manually drive the tool, then transition to automated spidering/testing. This approach works well if the tool offers it and if you don't mind manually handling the second authentication factor.
  2. write a plugin for the tool to log in. If the tool lets you write plugins, and if you can automate the second factor (like replaying a fingerprint scan, or using an optical scanner for a hardware token, etc.), then you can add functionality to the tool to handle this particular form of two factor authn.
  3. write a proxy to handle the authentication. If you can't write a plugin, write a proxy server and either configure the original scanner to use your proxy or just arp spoof to mitm the traffic. Use your proxy server to completely hijack the session, perform the authentication, and then return the session back to the original tool.
  4. disable two factor authn for your account/system. Simply disabling two factor authn will make it easier for the tool to get in. Of course, this requires that the product is under test can be so configured, and you'll have to scan twice - once to cover the authn screens, and once to cover the rest of the product.

In order to receive the sms response, either you'll need to register your phone and write some code to receive the sms and forward it to your addln/proxy; or you'll need to provide a URL to which to send the SMS that either points directly to your addon/proxy or that you can corward to your addin/proxy, again with custom code.

In order to deal with false positives, you'll need to review the results and trim them out yourself. Large numbers of False positives are one of the challenges of working with automated scanning tools.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.