Yippee-Ki-Yay MFA'er - Justin Hutchens ("Hutch")

Justin Hutchens ("Hutch"), founder of SocioSploit, presents research on bypassing multi-factor authentication (MFA) through real-time session instantiation and credential replay attacks [00:00]. Hutchens explains that while MFA has significantly raised the barrier against static password reuse, many implementations remain vulnerable to sophisticated reverse proxy and automated session hijacking techniques [06:26].

The presentation demonstrates a red team attack workflow simulating an engagement against a fictitious enterprise (Dunder Mifflin) [06:26]. Hutchens shows how to clone target login portals and host dynamic credential harvester services on deceptive lookalike domains [14:03, 21:45]. Using Python automation libraries including Selenium and PyAutoGUI, he demonstrates intercepting usernames, passwords, and secondary authentication codes (SMS OTPs or push approvals) and immediately replaying them into the legitimate target enterprise service in real time [28:55, 36:09].

By instantiating an authenticated session on the backend infrastructure (such as VMware Horizon or Microsoft 365) before the session token expires, the attacker successfully hijacks the victim's session cookies and establishes persistent administrative access [36:09]. Hutchens reviews mitigation strategies, stressing the critical necessity of FIDO2 WebAuthn hardware security keys, which enforce cryptographic origin binding and inherently resist proxy-based phishing attacks [42:39].

(AI summary — Gemini Flash)