search

msemple1111 / kahoot-hack

A suite of tools for easily manipulating the kahoot.it quiz platform
GNU General Public License v3.0
66 stars 27 forks source link

Two-Factor Authentication Option #7

Open KyrneDev opened 7 years ago

KyrneDev commented 7 years ago

Kahoot has introduced a new two-factor authentication option. I've only glanced at the code, but it looks to be very JavaScript reliant.

msemple1111 commented 7 years ago

Thanks for letting me know, it looks relatively easy to fix.

KyrneDev commented 7 years ago

So looking at it from the "instructor's" side, the code changes every 7 seconds...

msemple1111 commented 7 years ago

I have fixed it for play.py at da8ccb1. Because it only last 7 seconds I'm just trying to work out the best way of solving it for flood.py because it takes longer than 7 seconds for all the players to connect. At the moment the only solution would be for the player to enter the code every 7 seconds.

KyrneDev commented 7 years ago

I feel like that's not too much of a hassle. Maybe have it spam for 7 seconds, and or detect when the code changes, and prompt for a new code.

KyrneDev commented 7 years ago

Any updates?

msemple1111 commented 7 years ago

The code only has 24 possibilities (4 factorial), so im guessing you can just brute force it within 7 seconds (maybe 2), then spam user names until the 7 seconds are up. I'm currently testing this theory.

KyrneDev commented 7 years ago

You could have the user input the code then spam for 7 seconds, then have them answer it again

msemple1111 commented 7 years ago

It takes the user (me) around 5-8 seconds for me to answer the code and kahoot confirm its correct. I think that it would be impractical to spam for only 2 seconds before having to enter the code again.