Multi-Factor Authentication

Multi-Factor Authentication (MFA) plays an important role in modern-day applications. Instead of just relying on a password, MFA throws in extra layers of defense. Basically, MFA is a combination of different checks. It might be something you know (like a password), something you have (like your smartphone), and something you are (like a fingerprint). By using these layers, MFA makes it much tougher for threat actors to access user accounts or applications.

Objectives

By the end of this room, you will:

• Understand the operational principles of MFA and its significance in strengthening an application's security posture.
• Explore the different types of authentication factors used in MFA setups.
• Gain insights into practical scenarios where MFA is implemented to protect sensitive data and systems.

Prerequisites

Before starting this room, you should have a basic understanding of the following concepts:

• Familiarity with the general concepts of authentication mechanisms, including knowledge of how passwords and simple authentication processes work.
• Basic proficiency in navigating and using the Linux command line.
• Completion of the Enumeration & Brute Force room.

Starting the Machine

Deploy the target VM attached to this task by pressing the green Start Machine button. After obtaining the machine's generated IP address, you can either use the AttackBox or your own VM connected to TryHackMe's VPN.

Add MACHINE_IP to your /etc/hosts file. For example:

           MACHINE_IP    mfa.thm
        

We will be using the web application running on this machine in the upcoming tasks.