Bypassing Multi-Factor Authentication with Real-Time Session Replay Proxies
Justin Hutchens demonstrates bypassing Multi-Factor Authentication (MFA) using real-time adversary-in-the-middle reverse proxies to capture authenticated session tokens.
Summary
The Evolution of Phishing Beyond Password Harvesting
With organizations broadly enforcing Multi-Factor Authentication (MFA), traditional credential harvesting phishing landing pages are no longer sufficient for initial access.
Architecture of Adversary-in-the-Middle (AiTM) Proxies
Justin Hutchens breaks down how reverse-proxy frameworks (e.g., Evilginx) intercept live authentication traffic between victims and legitimate identity providers.
Stealing Authenticated Session Cookies and Tokens in Real Time
The speaker illustrates how proxying legitimate MFA prompts allows attackers to harvest post-authentication session cookies, bypassing TOTP and push notifications.
Defensive Countermeasures: FIDO2 and Conditional Access
The presentation explores robust defensive mitigations—including hardware-bound FIDO2/WebAuthn keys, certificate-based authentication, and continuous token evaluation.
Related talks
Creator Stage·19 min
Katherine Rackliffe
Presents empirical results from a university research study evaluating user vulnerability and defensive safeguards against AI voice-cloned vishing attacks.
Main Stage·43 min
Keanu Nys
Demonstrates how red teams can abuse legitimate Microsoft login branding parameters and OAuth endpoints to host convincing, high-trust phishing infrastructure.
Main Stage·36 min
Harrison Sand · Erlend Leiknes
Analyzes the evolution of enterprise phishing defense and demonstrates novel reverse-proxy adversary-in-the-middle tradecraft to bypass modern authentication.