I'm going to show you how hackers bypass 2FA

@remy_engineering

122.6K followers · usually 50.5K views a post

Views

2.2M

Likes

185.7K

Comments

1.2K

Shares

18.8K

SoundTikTok sound · original sound - remy_engineering

Promoted product

Bootcamp

Why it worked

The video provides a compelling and potentially alarming demonstration of how easily security measures like 2FA can be bypassed, creating a strong incentive for viewers to learn more about cybersecurity. The "soft sell" approach, where the promotion of the bootcamp comes at the end after providing valuable educational content, makes it more likely to be well-received.

Summary

The video demonstrates how session hijacking can bypass two-factor authentication by copying and replacing a session ID between browser sessions. It then promotes a bootcamp that teaches these cybersecurity techniques in depth.

Structure

1Introduction to session hijacking and its bypass of 2FA
2Demonstration of session hijacking using browser developer tools
3Explanation of the risks and best practices for account security
4Promotion of a cybersecurity bootcamp

Product placement

The video demonstrates a "session hijacking" technique using browser developer tools to access an Instagram account without a password or 2FA. It then promotes a "bootcamp" for learning cybersecurity techniques, with a link in the bio.

Original caption

Think 2FA makes you impossible to hack? Think again. In this video, I explain how session hijacking works and how you can better protect your accounts. ⚠️ For educational and cybersecurity awareness purposes only. What should I explain next? #cybersecurity #hacker #cyber #linux #engineering

More from @remy_engineering

Call to action

Link in bio if you want further than just the basics.

On-screen text

How Hackers Bypass 2FA DISCLAIMER This is for educational purposes only, and you should never use this to harm anyone. Think of this method like having a wristband at a theme park to prove that you can go on the rides, rather than having to show your ID each time This method is called session hijacking Here's the attack on a environment On your first account, right click anywhere on the and select inspect or control + shift + I This opens developer tools Go to the application tab, then cookies You'll see the session ID Copy that value Now open another browser where you're logged into different account Navigate to the same open the same cookies section, find the session ID and replace it with the one you copied from the first Refresh the page You're now logged into first account You completely bypass password and 2FA You're in Just like that This is exactly why you should never stay logged on public computers 3 Mistakes That Get You Hacked Never stay logged in on public computers Sign out of ALL devices regularly Never use public WiFi without protection This was just a glimpse If you want to really master these techniques and security from the ground up, I teach all of this in depth in camp Link in bio if you want further than just the basics

Transcript

I'm going to show you how hackers bypass two factor authentication. This specific method even if you have the strongest password in the entire world. This is for educational purposes only, and you should never use this to harm anyone. Think of this method like having a wristband at a theme park to prove that you can go on the rides, rather than having to show your ID each time. This method is called session hijacking. Here's the attack on a vulnerable test environment. On your first account, right click anywhere on the page and select inspect or control + shift + I. This opens developer tools. Go to the application tab, then cookies. You'll see the session ID. Copy that value. Now open another browser where you're logged into a different account. Navigate to the same open the same cookies section, find the session ID and replace it with the one you copied from the first. Refresh the page. You're now logged into the first account. You completely bypass password and 2FA. You're in. Just like that. This is exactly why you should never stay logged in on public computers. Always sign out of all devices regularly and be careful on public Wi-Fi. Now, this was just a glimpse. If you want to really master these techniques and understand cyber security from the ground up, I teach all of this in depth in my bootcamp. Link in bio if you want further than just the basics.