Update backend/scanners/mfa_bypass_scanner.py

backend/scanners/mfa_bypass_scanner.py

@@ -1,357 +1,356 @@
-
-"""
-mfa_bypass_scanner.py — Multi-Factor Authentication Bypass Scanner
-===================================================================
-Expert-grade rewrite (GAP-019 fix):
-  1. OTP brute-force feasibility (rate limiting check — tries 10 OTPs)
-  2. OTP validity window detection (how long does an OTP remain valid)
-  3. OTP reuse after consumption (submit same code twice)
-  4. Backup code entropy check (common patterns)
-  5. MFA skip via parameter manipulation (mfa_required=false)
-  6. Recovery flow bypass (does resetting password bypass MFA)
-  7. Response-based MFA state detection
-"""
-import json, time, urllib.parse, re
-from scanners.base_scanner import BaseScanner
-
-# Common MFA/OTP endpoints to probe
-OTP_ENDPOINTS = [
-    "/api/mfa/verify",
-    "/api/2fa/verify",
-    "/api/auth/otp",
-    "/api/otp/verify",
-    "/api/verify",
-    "/auth/2fa",
-    "/auth/mfa",
-    "/login/otp",
-    "/login/2fa",
-    "/account/2fa/verify",
-    "/users/mfa/confirm",
-    "/security/2fa",
-]
-
-# Parameters often used to bypass MFA
-BYPASS_PARAMS = [
-    {"mfa_required": False,  "skip_mfa": True},
-    {"two_factor_skip": "1", "bypass_mfa": "true"},
-    {"mfa": "bypass",        "otp": "000000"},
-    {"verify": "skip"},
-]
-
-# Common weak/test OTP codes to check rate limiting
-TEST_OTPS = ["000000", "111111", "123456", "654321", "999999",
-             "000001", "000002", "000003", "000004", "000005"]
-
-# MFA-related response patterns
-MFA_PRESENT_PATTERNS = [
-    "two.factor", "2fa", "mfa", "otp", "verification code",
-    "authenticator", "6-digit", "one-time", "passcode",
-]
-
-MFA_SUCCESS_PATTERNS = [
-    '"success":true', '"verified":true', '"authenticated":true',
-    '"token":', '"access_token":', "welcome", "dashboard",
-]
-
-
-class MfaBypassScanner(BaseScanner):
-    SCANNER_NAME = "MFA Bypass Scanner"
-    _SCANNER_KEY = "mfa_bypass"
-
-    def __init__(self, scan_id, target, domain, **kwargs):
-        super().__init__(scan_id, target, domain, **kwargs)
-
-    def run(self) -> list:
-        self.log("INFO", f"[MFABypass] Scanning {self.target} for MFA bypass vectors...")
-        parsed = urllib.parse.urlparse(self.target)
-        base   = f"{parsed.scheme}://{parsed.netloc}"
-
-        mfa_endpoints = self._discover_mfa_endpoints(base)
-        if not mfa_endpoints:
-            self.log("INFO", "[MFABypass] No MFA/OTP endpoints detected.")
-            return self.vulns
-
-        self.log("INFO", f"[MFABypass] Found {len(mfa_endpoints)} MFA endpoint(s): {mfa_endpoints}")
-
-        for endpoint in mfa_endpoints[:3]:
-            url = base + endpoint if not endpoint.startswith("http") else endpoint
-            self._test_rate_limiting(url)
-            self._test_otp_reuse(url)
-            self._test_mfa_skip_params(url)
-
-        # Check recovery/reset flow bypass
-        self._test_recovery_bypass(base)
-
-        # Additional MFA tests
-        self._test_mfa_method_enumeration(base, mfa_endpoints)
-        self._test_backup_code_brute_force(base)
-
-        if not self.vulns:
-            self.log("SUCCESS", "[MFABypass] No MFA bypass vulnerabilities detected.")
-        return self.vulns
-
-    # ── Endpoint discovery ────────────────────────────────────────────────
-    def _discover_mfa_endpoints(self, base: str) -> list[str]:
-        """Check which OTP endpoints exist (200 or 422/400 = accepts input)."""
-        found = []
-        for ep in OTP_ENDPOINTS:
-            _, status = self._make_request(base + ep, "POST",
-                json.dumps({"code": "000000"}).encode(),
-                {"Content-Type": "application/json"})
-            # 200, 400, 422 = endpoint exists; 404 = does not
-            if status in (200, 201, 400, 401, 403, 422, 429):
-                found.append(ep)
-        return found
-
-    # ── 1. Rate limiting / brute-force ────────────────────────────────────
-    def _test_rate_limiting(self, url: str):
-        """
-        Submit 10 sequential wrong OTP codes.
-        If none return 429 (Too Many Requests) or account lockout signals,
-        MFA brute-force is feasible (10^6 OTPs in ~millions of requests).
-        """
-        self.log("INFO", f"[MFABypass] Testing OTP rate limiting on {url}...")
-        got_blocked = False
-
-        for i, otp in enumerate(TEST_OTPS):
-            resp, status = self._make_request(
-                url, "POST",
-                json.dumps({"code": otp, "otp": otp, "token": otp}).encode(),
-                {"Content-Type": "application/json"}
-            )
-            if status == 429:
-                got_blocked = True
-                self.log("SUCCESS", f"[MFABypass] Rate limiting active (429 on attempt {i+1}).")
-                break
-            if resp and any(p in resp.lower() for p in ["locked", "too many", "blocked", "suspended"]):
-                got_blocked = True
-                self.log("SUCCESS", f"[MFABypass] Account lockout triggered on attempt {i+1}.")
-                break
-            # Small delay to avoid hammering
-            time.sleep(0.3)
-
-        if not got_blocked:
-            self.add_vuln(
-                title=f"MFA OTP Brute-Force — No Rate Limiting at `{url}`",
-                severity="High",
-                category="Authentication",
-                cvss_score=8.1,
-                confidence="High",
-                references=["https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html"],
-                description=(
-                    f"Submitted **{len(TEST_OTPS)} consecutive invalid OTP codes** to `{url}` "
-                    "without triggering rate limiting (HTTP 429) or account lockout.\n\n"
-                    "A 6-digit TOTP has 10^6 (1,000,000) possible values. Without rate limiting, "
-                    "an attacker can brute-force the OTP in minutes via automation, completely "
-                    "defeating MFA protection."
-                ),
-                remediation=(
-                    "1. Implement rate limiting: max 5 OTP attempts per 15 minutes per account.\n"
-                    "2. Lock the account after 10 failed MFA attempts.\n"
-                    "3. Return HTTP 429 with `Retry-After` header on rate limit.\n"
-                    "4. Notify the user of failed MFA attempts via email.\n"
-                    "5. Consider exponential backoff between allowed attempts."
-                ),
-                cwe_ids=["CWE-308"],
-                owasp_category="A07:2021 – Identification and Authentication Failures",
-            )
-
-    # ── 2. OTP reuse ──────────────────────────────────────────────────────
-    def _test_otp_reuse(self, url: str):
-        """
-        Submit the same OTP code twice — if the second attempt also 'succeeds'
-        (or doesn't return 'already used'), the OTP is reusable.
-        """
-        self.log("INFO", f"[MFABypass] Testing OTP reuse on {url}...")
-        test_otp = "123456"
-        results = []
-
-        for _ in range(2):
-            resp, status = self._make_request(
-                url, "POST",
-                json.dumps({"code": test_otp, "otp": test_otp}).encode(),
-                {"Content-Type": "application/json"}
-            )
-            results.append((status, resp or ""))
-
-        # If second attempt doesn't explicitly say "code already used" or similar
-        _, resp2 = results[1]
-        if resp2 and not any(p in resp2.lower() for p in
-                             ["already used", "expired", "invalid", "used", "consumed"]):
-            # Could indicate reuse is allowed (or endpoint just gives generic errors)
-            self.log("INFO",
-                "[MFABypass] OTP reuse check: second submission did not return 'already used' signal "
-                "(manual verification recommended).")
-            self.add_vuln(
-                title=f"Possible OTP Reuse — No 'Already Used' Signal at `{url}`",
-                severity="Medium",
-                category="Authentication",
-                cvss_score=6.5,
-                confidence="Low",
-                description=(
-                    f"Submitting the same OTP code (`{test_otp}`) twice to `{url}` "
-                    "did not produce an 'already used' or 'code consumed' response on "
-                    "the second attempt. This may indicate OTP codes can be reused, "
-                    "allowing an attacker who intercepts a valid OTP to replay it."
-                ),
-                remediation=(
-                    "1. Invalidate OTP codes immediately after first successful verification.\n"
-                    "2. Store consumed codes in a short-lived cache (TTL = OTP validity window).\n"
-                    "3. Return a specific error: `{\"error\": \"code_already_used\"}` on replay attempts."
-                ),
-                cwe_ids=["CWE-308"],
-                owasp_category="A07:2021 – Identification and Authentication Failures",
-            )
-
-    # ── 3. MFA skip via parameter manipulation ────────────────────────────
-    def _test_mfa_skip_params(self, url: str):
-        """Inject MFA bypass parameters in the request body."""
-        self.log("INFO", f"[MFABypass] Testing MFA parameter bypass on {url}...")
-        for bypass_dict in BYPASS_PARAMS:
-            payload = json.dumps({**bypass_dict, "code": "000000"}).encode()
-            resp, status = self._make_request(
-                url, "POST", payload, {"Content-Type": "application/json"}
-            )
-            if resp and any(p in resp.lower() for p in MFA_SUCCESS_PATTERNS):
-                self.add_vuln(
-                    title=f"MFA Bypass via Parameter Manipulation at `{url}`",
-                    severity="Critical",
-                    category="Authentication",
-                    cvss_score=9.1,
-                    confidence="Confirmed",
-                    description=(
-                        f"MFA was bypassed by injecting `{bypass_dict}` into the request body. "
-                        "The server returned success signals despite an invalid OTP code."
-                    ),
-                    remediation=(
-                        "1. Never expose MFA control flags (`mfa_required`, `skip_mfa`) to the client.\n"
-                        "2. Enforce MFA server-side based on session state, not request parameters.\n"
-                        "3. Treat any extra/unknown parameters in MFA requests as suspicious."
-                    ),
-                    payload=json.dumps(bypass_dict),
-                    cwe_ids=["CWE-308"],
-                    owasp_category="A07:2021 – Identification and Authentication Failures",
-                )
-                return
-
-    # ── 4. Recovery flow bypass ───────────────────────────────────────────
-    def _test_recovery_bypass(self, base: str):
-        """Check if password reset endpoint bypasses MFA."""
-        reset_endpoints = [
-            "/api/auth/reset-password",
-            "/api/password/reset",
-            "/password-reset",
-            "/forgot-password",
-        ]
-        for ep in reset_endpoints:
-            resp, status = self._make_request(
-                base + ep, "POST",
-                json.dumps({"email": "test@test.local"}).encode(),
-                {"Content-Type": "application/json"}
-            )
-            if status in (200, 202):
-                self.log("INFO",
-                    f"[MFABypass] Password reset endpoint exists: {ep} — "
-                    "manual verification needed: does reset bypass MFA?")
-                self.add_vuln(
-                    title=f"Password Reset Endpoint Exists — MFA Bypass Risk ({ep})",
-                    severity="Low",
-                    category="Authentication",
-                    cvss_score=0.0,
-                    confidence="Low",
-                    description=(
-                        f"A password reset endpoint was found at `{base + ep}` (HTTP {status}). "
-                        "If the reset flow doesn't re-verify MFA after password change, "
-                        "an attacker with email access can reset the password and log in "
-                        "without completing MFA verification."
-                    ),
-                    remediation=(
-                        "1. Require MFA re-verification after password reset before granting full session access.\n"
-                        "2. Invalidate all existing sessions after password reset.\n"
-                        "3. Implement re-authentication for sensitive operations (NIST 800-63B §5.2.5)."
-                    ),
-                    cwe_ids=["CWE-308"],
-                    owasp_category="A07:2021 – Identification and Authentication Failures",
-                )
-                break
-
-    # ── 5. MFA method enumeration ─────────────────────────────────────────
-    def _test_mfa_method_enumeration(self, base: str, mfa_endpoints: list[str]):
-        """Enumerate available MFA methods by probing different endpoints."""
-        method_paths = [
-            "/api/mfa/methods", "/api/2fa/methods", "/api/auth/mfa-methods",
-            "/api/user/mfa", "/api/account/2fa", "/api/security/mfa",
-        ]
-        for path in method_paths:
-            url = base + path
-            resp, status = self._make_request(url)
-            if resp and status == 200:
-                try:
-                    methods = json.loads(resp)
-                    if isinstance(methods, dict) and any(k in methods for k in
-                        ["methods", "totp", "sms", "email", "backup_codes", "u2f", "webauthn"]):
-                        self.add_vuln(
-                            title="MFA Method Enumeration Possible",
-                            severity="Medium",
-                            category="Authentication",
-                            cvss_score=5.3,
-                            description=f"MFA configuration endpoint exposed at `{url}`. "
-                                f"Enumerates available authentication methods and allows "
-                                f"attackers to identify the weakest MFA method to target.",
-                            evidence=f"MFA methods available: {resp[:200]}",
-                            payload=url,
-                            request_details=f"GET {url}",
-                            response_details=f"HTTP {status}",
-                            confidence="Confirmed",
-                            remediation="1. Restrict access to MFA configuration endpoints.\n"
-                                "2. Require re-authentication before viewing MFA settings.\n"
-                                "3. Do not enumerate available methods for unauthenticated users.",
-                            cwe_ids=["CWE-308"],
-                            owasp_category="A07:2021 – Identification and Authentication Failures",
-                        )
-                        return
-                except json.JSONDecodeError:
-                    continue
-
-    # ── 6. Backup code brute force ────────────────────────────────────────
-    def _test_backup_code_brute_force(self, base: str):
-        """Test if backup codes can be brute-forced (typically 8-10 digit codes)."""
-        backup_endpoints = [
-            "/api/mfa/backup-codes", "/api/2fa/backup", "/api/auth/backup-code",
-            "/api/mfa/verify-backup", "/api/auth/verify-backup-code",
-        ]
-        for ep in backup_endpoints:
-            url = base + ep
-            # Try a few guesses to see if rate limiting exists
-            for code in ["00000000", "11111111", "12345678", "0000000000"]:
-                resp, status = self._make_request(
-                    url, "POST",
-                    json.dumps({"code": code, "backup_code": code}).encode(),
-                    {"Content-Type": "application/json"}
-                )
-                if status == 429:
-                    self.log("SUCCESS", f"[MFABypass] Backup code rate limiting active at {url}")
-                    return
-                if resp and status == 200:
-                    self.add_vuln(
-                        title="Backup Code Accepted — Potential Brute-Force Vector",
-                        severity="Critical",
-                        category="Authentication",
-                        cvss_score=9.0,
-                        description=f"Backup code endpoint at `{url}` accepted a common code "
-                            f"`{code}`. If backup codes are short or predictable, attackers "
-                            f"can brute-force them to bypass MFA entirely.",
-                        evidence=f"Backup code `{code}` accepted (status {status})",
-                        payload=f"code={code}",
-                        request_details=f"POST {url} with code={code}",
-                        response_details=f"HTTP {status}",
-                        confidence="Confirmed",
-                        remediation="1. Use cryptographically random backup codes (minimum 128 bits).\n"
-                            "2. Invalidate backup codes after first use.\n"
-                            "3. Implement rate limiting on backup code verification.\n"
-                            "4. Alert users when backup codes are used.",
-                        cwe_ids=["CWE-308"],
-                        owasp_category="A07:2021 – Identification and Authentication Failures",
-                    )
-                    return
-                time.sleep(0.2)
+
+"""
+mfa_bypass_scanner.py — Multi-Factor Authentication Bypass Scanner
+===================================================================
+Expert-grade rewrite (GAP-019 fix):
+  1. OTP brute-force feasibility (rate limiting check — tries 10 OTPs)
+  2. OTP validity window detection (how long does an OTP remain valid)
+  3. OTP reuse after consumption (submit same code twice)
+  4. Backup code entropy check (common patterns)
+  5. MFA skip via parameter manipulation (mfa_required=false)
+  6. Recovery flow bypass (does resetting password bypass MFA)
+  7. Response-based MFA state detection
+"""
+import json, time, urllib.parse, re
+from scanners.base_scanner import BaseScanner
+
+# Common MFA/OTP endpoints to probe
+OTP_ENDPOINTS = [
+    "/api/mfa/verify",
+    "/api/2fa/verify",
+    "/api/auth/otp",
+    "/api/otp/verify",
+    "/api/verify",
+    "/auth/2fa",
+    "/auth/mfa",
+    "/login/otp",
+    "/login/2fa",
+    "/account/2fa/verify",
+    "/users/mfa/confirm",
+    "/security/2fa",
+]
+
+# Parameters often used to bypass MFA
+BYPASS_PARAMS = [
+    {"mfa_required": False,  "skip_mfa": True},
+    {"two_factor_skip": "1", "bypass_mfa": "true"},
+    {"mfa": "bypass",        "otp": "000000"},
+    {"verify": "skip"},
+]
+
+# Common weak/test OTP codes to check rate limiting
+TEST_OTPS = ["000000", "111111", "123456", "654321", "999999",
+             "000001", "000002", "000003", "000004", "000005"]
+
+# MFA-related response patterns
+MFA_PRESENT_PATTERNS = [
+    "two.factor", "2fa", "mfa", "otp", "verification code",
+    "authenticator", "6-digit", "one-time", "passcode",
+]
+
+MFA_SUCCESS_PATTERNS = [
+    '"success":true', '"verified":true', '"authenticated":true',
+    '"token":', '"access_token":', "welcome", "dashboard",
+]
+
+
+class MfaBypassScanner(BaseScanner):
+    SCANNER_NAME = "MFA Bypass Scanner"
+    _SCANNER_KEY = "mfa_bypass"
+
+    def __init__(self, scan_id, target, domain, **kwargs):
+        super().__init__(scan_id, target, domain, **kwargs)
+
+    def run(self) -> list:
+        self.log("INFO", f"[MFABypass] Scanning {self.target} for MFA bypass vectors...")
+        parsed = urllib.parse.urlparse(self.target)
+        base   = f"{parsed.scheme}://{parsed.netloc}"
+
+        mfa_endpoints = self._discover_mfa_endpoints(base)
+        if not mfa_endpoints:
+            self.log("INFO", "[MFABypass] No MFA/OTP endpoints detected.")
+            return self.vulns
+
+        self.log("INFO", f"[MFABypass] Found {len(mfa_endpoints)} MFA endpoint(s): {mfa_endpoints}")
+
+        for endpoint in mfa_endpoints[:3]:
+            url = base + endpoint if not endpoint.startswith("http") else endpoint
+            self._test_rate_limiting(url)
+            self._test_otp_reuse(url)
+            self._test_mfa_skip_params(url)
+
+        # Check recovery/reset flow bypass
+        self._test_recovery_bypass(base)
+
+        # Additional MFA tests
+        self._test_mfa_method_enumeration(base, mfa_endpoints)
+        self._test_backup_code_brute_force(base)
+
+        if not self.vulns:
+            self.log("SUCCESS", "[MFABypass] No MFA bypass vulnerabilities detected.")
+        return self.vulns
+
+    # ── Endpoint discovery ────────────────────────────────────────────────
+    def _discover_mfa_endpoints(self, base: str) -> list[str]:
+        """Check which OTP endpoints exist (200 or 422/400 = accepts input)."""
+        found = []
+        for ep in OTP_ENDPOINTS:
+            _, status = self._make_request(base + ep, "POST",
+                json.dumps({"code": "000000"}).encode(),
+                {"Content-Type": "application/json"})
+            # 200, 400, 422 = endpoint exists; 404 = does not
+            if status in (200, 201, 400, 401, 403, 422, 429):
+                found.append(ep)
+        return found
+
+    # ── 1. Rate limiting / brute-force ────────────────────────────────────
+    def _test_rate_limiting(self, url: str):
+        """
+        Submit 10 sequential wrong OTP codes.
+        If none return 429 (Too Many Requests) or account lockout signals,
+        MFA brute-force is feasible (10^6 OTPs in ~millions of requests).
+        """
+        self.log("INFO", f"[MFABypass] Testing OTP rate limiting on {url}...")
+        got_blocked = False
+
+        for i, otp in enumerate(TEST_OTPS):
+            resp, status = self._make_request(
+                url, "POST",
+                json.dumps({"code": otp, "otp": otp, "token": otp}).encode(),
+                {"Content-Type": "application/json"}
+            )
+            if status == 429:
+                got_blocked = True
+                self.log("SUCCESS", f"[MFABypass] Rate limiting active (429 on attempt {i+1}).")
+                break
+            if resp and any(p in resp.lower() for p in ["locked", "too many", "blocked", "suspended"]):
+                got_blocked = True
+                self.log("SUCCESS", f"[MFABypass] Account lockout triggered on attempt {i+1}.")
+                break
+            # No artificial sleep — network round-trips already throttle the rate
+
+        if not got_blocked:
+            self.add_vuln(
+                title=f"MFA OTP Brute-Force — No Rate Limiting at `{url}`",
+                severity="High",
+                category="Authentication",
+                cvss_score=8.1,
+                confidence="High",
+                references=["https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html"],
+                description=(
+                    f"Submitted **{len(TEST_OTPS)} consecutive invalid OTP codes** to `{url}` "
+                    "without triggering rate limiting (HTTP 429) or account lockout.\n\n"
+                    "A 6-digit TOTP has 10^6 (1,000,000) possible values. Without rate limiting, "
+                    "an attacker can brute-force the OTP in minutes via automation, completely "
+                    "defeating MFA protection."
+                ),
+                remediation=(
+                    "1. Implement rate limiting: max 5 OTP attempts per 15 minutes per account.\n"
+                    "2. Lock the account after 10 failed MFA attempts.\n"
+                    "3. Return HTTP 429 with `Retry-After` header on rate limit.\n"
+                    "4. Notify the user of failed MFA attempts via email.\n"
+                    "5. Consider exponential backoff between allowed attempts."
+                ),
+                cwe_ids=["CWE-308"],
+                owasp_category="A07:2021 – Identification and Authentication Failures",
+            )
+
+    # ── 2. OTP reuse ──────────────────────────────────────────────────────
+    def _test_otp_reuse(self, url: str):
+        """
+        Submit the same OTP code twice — if the second attempt also 'succeeds'
+        (or doesn't return 'already used'), the OTP is reusable.
+        """
+        self.log("INFO", f"[MFABypass] Testing OTP reuse on {url}...")
+        test_otp = "123456"
+        results = []
+
+        for _ in range(2):
+            resp, status = self._make_request(
+                url, "POST",
+                json.dumps({"code": test_otp, "otp": test_otp}).encode(),
+                {"Content-Type": "application/json"}
+            )
+            results.append((status, resp or ""))
+
+        # If second attempt doesn't explicitly say "code already used" or similar
+        _, resp2 = results[1]
+        if resp2 and not any(p in resp2.lower() for p in
+                             ["already used", "expired", "invalid", "used", "consumed"]):
+            # Could indicate reuse is allowed (or endpoint just gives generic errors)
+            self.log("INFO",
+                "[MFABypass] OTP reuse check: second submission did not return 'already used' signal "
+                "(manual verification recommended).")
+            self.add_vuln(
+                title=f"Possible OTP Reuse — No 'Already Used' Signal at `{url}`",
+                severity="Medium",
+                category="Authentication",
+                cvss_score=6.5,
+                confidence="Low",
+                description=(
+                    f"Submitting the same OTP code (`{test_otp}`) twice to `{url}` "
+                    "did not produce an 'already used' or 'code consumed' response on "
+                    "the second attempt. This may indicate OTP codes can be reused, "
+                    "allowing an attacker who intercepts a valid OTP to replay it."
+                ),
+                remediation=(
+                    "1. Invalidate OTP codes immediately after first successful verification.\n"
+                    "2. Store consumed codes in a short-lived cache (TTL = OTP validity window).\n"
+                    "3. Return a specific error: `{\"error\": \"code_already_used\"}` on replay attempts."
+                ),
+                cwe_ids=["CWE-308"],
+                owasp_category="A07:2021 – Identification and Authentication Failures",
+            )
+
+    # ── 3. MFA skip via parameter manipulation ────────────────────────────
+    def _test_mfa_skip_params(self, url: str):
+        """Inject MFA bypass parameters in the request body."""
+        self.log("INFO", f"[MFABypass] Testing MFA parameter bypass on {url}...")
+        for bypass_dict in BYPASS_PARAMS:
+            payload = json.dumps({**bypass_dict, "code": "000000"}).encode()
+            resp, status = self._make_request(
+                url, "POST", payload, {"Content-Type": "application/json"}
+            )
+            if resp and any(p in resp.lower() for p in MFA_SUCCESS_PATTERNS):
+                self.add_vuln(
+                    title=f"MFA Bypass via Parameter Manipulation at `{url}`",
+                    severity="Critical",
+                    category="Authentication",
+                    cvss_score=9.1,
+                    confidence="Confirmed",
+                    description=(
+                        f"MFA was bypassed by injecting `{bypass_dict}` into the request body. "
+                        "The server returned success signals despite an invalid OTP code."
+                    ),
+                    remediation=(
+                        "1. Never expose MFA control flags (`mfa_required`, `skip_mfa`) to the client.\n"
+                        "2. Enforce MFA server-side based on session state, not request parameters.\n"
+                        "3. Treat any extra/unknown parameters in MFA requests as suspicious."
+                    ),
+                    payload=json.dumps(bypass_dict),
+                    cwe_ids=["CWE-308"],
+                    owasp_category="A07:2021 – Identification and Authentication Failures",
+                )
+                return
+
+    # ── 4. Recovery flow bypass ───────────────────────────────────────────
+    def _test_recovery_bypass(self, base: str):
+        """Check if password reset endpoint bypasses MFA."""
+        reset_endpoints = [
+            "/api/auth/reset-password",
+            "/api/password/reset",
+            "/password-reset",
+            "/forgot-password",
+        ]
+        for ep in reset_endpoints:
+            resp, status = self._make_request(
+                base + ep, "POST",
+                json.dumps({"email": "test@test.local"}).encode(),
+                {"Content-Type": "application/json"}
+            )
+            if status in (200, 202):
+                self.log("INFO",
+                    f"[MFABypass] Password reset endpoint exists: {ep} — "
+                    "manual verification needed: does reset bypass MFA?")
+                self.add_vuln(
+                    title=f"Password Reset Endpoint Exists — MFA Bypass Risk ({ep})",
+                    severity="Low",
+                    category="Authentication",
+                    cvss_score=0.0,
+                    confidence="Low",
+                    description=(
+                        f"A password reset endpoint was found at `{base + ep}` (HTTP {status}). "
+                        "If the reset flow doesn't re-verify MFA after password change, "
+                        "an attacker with email access can reset the password and log in "
+                        "without completing MFA verification."
+                    ),
+                    remediation=(
+                        "1. Require MFA re-verification after password reset before granting full session access.\n"
+                        "2. Invalidate all existing sessions after password reset.\n"
+                        "3. Implement re-authentication for sensitive operations (NIST 800-63B §5.2.5)."
+                    ),
+                    cwe_ids=["CWE-308"],
+                    owasp_category="A07:2021 – Identification and Authentication Failures",
+                )
+                break
+
+    # ── 5. MFA method enumeration ─────────────────────────────────────────
+    def _test_mfa_method_enumeration(self, base: str, mfa_endpoints: list[str]):
+        """Enumerate available MFA methods by probing different endpoints."""
+        method_paths = [
+            "/api/mfa/methods", "/api/2fa/methods", "/api/auth/mfa-methods",
+            "/api/user/mfa", "/api/account/2fa", "/api/security/mfa",
+        ]
+        for path in method_paths:
+            url = base + path
+            resp, status = self._make_request(url)
+            if resp and status == 200:
+                try:
+                    methods = json.loads(resp)
+                    if isinstance(methods, dict) and any(k in methods for k in
+                        ["methods", "totp", "sms", "email", "backup_codes", "u2f", "webauthn"]):
+                        self.add_vuln(
+                            title="MFA Method Enumeration Possible",
+                            severity="Medium",
+                            category="Authentication",
+                            cvss_score=5.3,
+                            description=f"MFA configuration endpoint exposed at `{url}`. "
+                                f"Enumerates available authentication methods and allows "
+                                f"attackers to identify the weakest MFA method to target.",
+                            evidence=f"MFA methods available: {resp[:200]}",
+                            payload=url,
+                            request_details=f"GET {url}",
+                            response_details=f"HTTP {status}",
+                            confidence="Confirmed",
+                            remediation="1. Restrict access to MFA configuration endpoints.\n"
+                                "2. Require re-authentication before viewing MFA settings.\n"
+                                "3. Do not enumerate available methods for unauthenticated users.",
+                            cwe_ids=["CWE-308"],
+                            owasp_category="A07:2021 – Identification and Authentication Failures",
+                        )
+                        return
+                except json.JSONDecodeError:
+                    continue
+
+    # ── 6. Backup code brute force ────────────────────────────────────────
+    def _test_backup_code_brute_force(self, base: str):
+        """Test if backup codes can be brute-forced (typically 8-10 digit codes)."""
+        backup_endpoints = [
+            "/api/mfa/backup-codes", "/api/2fa/backup", "/api/auth/backup-code",
+            "/api/mfa/verify-backup", "/api/auth/verify-backup-code",
+        ]
+        for ep in backup_endpoints:
+            url = base + ep
+            # Try a few guesses to see if rate limiting exists
+            for code in ["00000000", "11111111", "12345678", "0000000000"]:
+                resp, status = self._make_request(
+                    url, "POST",
+                    json.dumps({"code": code, "backup_code": code}).encode(),
+                    {"Content-Type": "application/json"}
+                )
+                if status == 429:
+                    self.log("SUCCESS", f"[MFABypass] Backup code rate limiting active at {url}")
+                    return
+                if resp and status == 200:
+                    self.add_vuln(
+                        title="Backup Code Accepted — Potential Brute-Force Vector",
+                        severity="Critical",
+                        category="Authentication",
+                        cvss_score=9.0,
+                        description=f"Backup code endpoint at `{url}` accepted a common code "
+                            f"`{code}`. If backup codes are short or predictable, attackers "
+                            f"can brute-force them to bypass MFA entirely.",
+                        evidence=f"Backup code `{code}` accepted (status {status})",
+                        payload=f"code={code}",
+                        request_details=f"POST {url} with code={code}",
+                        response_details=f"HTTP {status}",
+                        confidence="Confirmed",
+                        remediation="1. Use cryptographically random backup codes (minimum 128 bits).\n"
+                            "2. Invalidate backup codes after first use.\n"
+                            "3. Implement rate limiting on backup code verification.\n"
+                            "4. Alert users when backup codes are used.",
+                        cwe_ids=["CWE-308"],
+                        owasp_category="A07:2021 – Identification and Authentication Failures",
+                    )
+                    return
+                # No sleep needed — network latency provides natural throttling