hunt-mfa-bypass

## Autonomous Testing Priority **Try workflow bypasses before brute force — they're faster and more likely to succeed.** **Pattern 1 — Skip the MFA step entirely (most automatable):** 1. Login with valid credentials → receive a "pre-MFA" session state 2. Without completing MFA, directly access a protected resource (`/dashboard`, `/api/me`, `/account/profile`) 3. If the response returns user data → MFA is enforced only in the UI, not server-side = Critical **Pattern 2 — OTP replay (reuse a consumed code):** 1. Complete a valid MFA flow to get a working OTP 2. Log out, log in again with the same credentials 3. Submit the same OTP again 4. If accepted → OTP is not invalidated after use **Pattern 3 — Submit obviously wrong OTP, observe response:** Try submitting `000000` or `123456`. If the response is 200 or returns a session token, OTP validation is broken or client-side only. **Pattern 4 — Partial / incremental validation (prefix oracle):** If a guessed full code is rejected, test whether the server validates the OTP **prefix-by-prefix** instead of all-or-nothing. Submit a short partial code and compare responses: 1. Submit a 1–3 digit value (e.g. `otp=1`, then `otp=12`, …) — for a POST verify endpoint the code goes in the **request body**, not the URL query string, or the server reads an empty value. 2. If a *correct* prefix gives a DIFFERENT response than a wrong one (a success/flag, a distinct message, or a different length/timing), the validator leaks correctness one ...