> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/external-pentest-playbook/attacking-login-portals/bypassing-mfa.md).
# Bypassing MFA
## Overview
Since the engagement is an **External Pentest** there usually isn't any kind of social engineering or interactions with the users to bypass **MFA.** This leaves us limited in our attack options
[MFASweep](https://github.com/dafthack/MFASweep) and[ ropci ](https://github.com/wunderwuzzi23/ropci) are great tools to bypass MFA. **Exchange Web Services (EWS)** can be used instead of **Outlook** to authenticate to O365 by using [MailSniper](https://github.com/dafthack/MailSniper).
MFASweep Example
{% hint style="info" %}
MailSniper will parse through the emails hunting passwords down
{% endhint %}
