Project 97: MFA Security Architecture

Module: Module 10: Advanced Detection Engineering & Zero-Day Research  |  Level: Advanced  | 
Primary tool: A free TOTP library (e.g. pyotp) + design review  |  Estimated time: 2–4 hours

Objective: Implement a working TOTP flow yourself to understand MFA’s real security properties and bypass risks.

Free lab environment

TryHackMe free rooms (Linux/Windows fundamentals) + VulnHub VMs — https://tryhackme.com/ and https://www.vulnhub.com/

VulnHub hosts hundreds of free, downloadable, intentionally vulnerable VMs built by the community for exactly this kind of practice; run them host-only inside VirtualBox/VMware. TryHackMe’s free-tier rooms provide disposable cloud targets when you’d rather not manage local VMs.

Lab workflow

1. Set up your target (your own local script/test app) inside an isolated VM/VLAN you fully control.
2. Using A free TOTP library (e.g. pyotp) + design review, run your baseline check with the specific goal of learning to implement a working TOTP flow yourself to understand MFA’s real security properties and bypass risks.
3. For every result, distinguish ‘expected/by design’ from ‘a real gap’ before acting on anything.
4. Apply one concrete fix for the most significant gap you found.
5. Re-run the same check after your fix and confirm, with evidence, that the specific gap is closed.
6. Write a one-paragraph note on why this class of issue matters beyond this one lab machine.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• your working TOTP generation/verification code and a successful test run
• your written note on one common MFA bypass technique (e.g. SIM swap, MFA fatigue/push-bombing) and a specific control against it

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.