Single Factor Access results not working correctly

dafthack / MFASweep

A tool for checking if MFA is enabled on multiple Microsoft Services

MIT License

1.38k stars 188 forks source link

Single Factor Access results not working correctly #10

Open EnriqueHernandezL opened 1 year ago

EnriqueHernandezL commented 1 year ago

I tested this a few days ago with a Conditional Access Policy that allowed Android access.

The script looks for some hard-coded string in the login response which is not there (anymore).

Looking at the response code instead fixed the issue, as it can tell apart whether MFA gets asked for or not.

TwistedSim commented 1 year ago

Which response code are you using? I don't see any difference between both cases. When MFA is in place, there is a new parameters in the data returned named "arrUserProofs". Maybe it could be used to infer the MFA state.