Introduction

If your application enforces Two-Factor Authentication (2FA/MFA), Astra's DAST scanner may not be able to log in and scan effectively without additional configuration. Below are four methods you can use to enable scanning on targets protected by MFA.

Prerequisites

• Access to the Target Settings in your Astra dashboard.

• The Chrome DevTools recorder to capture login sequences.

• For custom scripts, you must have the ability to export recordings as Puppeteer JS files.

Instructions

Option 1: Use a Static OTP for Staging Environments

This is the most seamless method for testing environments that allow a fixed code for bypass.

1. Verify your staging environment supports a static OTP..

2. Use the Chrome Login Recorder to record your login flow.

3. Enter the static OTP during the recording process as you normally would.

4. Upload the resulting recording file to the Target Settings > User credentials >Login Recording section of your dashboard.

5. Add your test user's email and password in Target Settings > User credentials

Option 2: Disable MFA on Dedicated Test Accounts

If static OTPs are not supported, you can bypass the prompt entirely by using an unprotected account.

1. Create a dedicated testing account within your application.

2. Disable MFA specifically for that account.

3. Record the login sequence (which will no longer show a 2FA prompt) and upload it to Login Recording.

4. Add this user's credentials to the User Roles section in the Astra dashboard.

Option 3: Custom Login Script (For TOTP-based MFA)

If you use an authenticator app (e.g., Google Authenticator), Astra can implement a script to generate these codes dynamically.

1. Record your login flow using Chrome and enter any valid OTP code during the process.

2. Export the recording as a Puppeteer JS file (ensure it is not a JSON file).

   

3. Ensure user credentials are saved in Target Settings.

4. Raise a support ticket at help@getastra.com including:

   • A link to your Target Settings page.

   • The exported JS file.

   • The TOTP MFA secret (seed) used to generate your codes.

5. Astra will implement the logic and notify you once the custom script is active.

Option 4: Set Authentication Headers Manually

This is a quick workaround for one-off scans but is not recommended for automated pipelines.

1. Log in to your application manually in your browser.

2. Open DevTools > Network tab and copy your Authorization header or session cookies.

3. Navigate to Target Settings > Advanced settings in the Astra dashboard.

4. Paste the header name and value there.

Option 5: Custom Login Script for Email OTP or Magic Link-based MFA

If your application sends a one-time password or magic link to the user's email instead of using an authenticator app, Astra can implement a custom script to retrieve and process these emails automatically.

1. Record your login flow using Chrome, triggering the OTP or magic link email as you normally would.

2. Export the recording as a Puppeteer JS file (ensure it is not a JSON file).

3. Ensure your test user's email and password are saved in Target Settings > User credentials.

4. Confirm your test account's inbox is reachable by Astra (for example, dast@getastra.com or its alias), since the application must send the OTP or magic link to this address.

5. Raise a support ticket at help@getastra.com including:

   • A link to your Target Settings page.

   • The exported JS file.

   • Confirmation of whether your app sends an OTP code or a magic link.

6. Astra will implement the logic to poll for the email, extract the OTP or magic link, and complete the login, then notify you once the custom script is active.

Expected Outcome

The scanner will be able to bypass 2FA prompts and perform an authenticated crawl, allowing it to identify vulnerabilities within restricted areas of your application.

Troubleshooting & Limitations

• Manual Header Expiration: Be aware that tokens copied manually will expire, requiring you to refresh them before every scan.

• Unsupported MFA: Astra currently supports TOTP-based and Email-based MFA (OTP or magic link) - SMS OTP support is not currently available.

• CI/CD Compatibility: Only Options 1, 2, and 3 are suitable for automated CI/CD pipelines.

• Connection Errors: If the scanner still cannot log in, ensure you have allowlisted Astra's static IP addresses in your firewall or MFA system.

Summary

For any questions or help with setup, please reach out to our support team via the in-dashboard support widget or by raising a support ticket.