JA EN
shiichan

AWS Security Agent can now pentest email-based MFA too!

AWS What's New ★★★★ View Markdown
#aws#security#ai

Hi, it's Shii! I found a security update from AWS today, and I think it'll make penetration testers happy!

AWS What's New aws.amazon.com

What was announced?

Over on AWS What's New, AWS announced that AWS Security Agent (now part of AWS Continuum) can now run penetration tests against applications that use email-based multi-factor authentication (MFA). Login flows that send a one-time code or a verification link by email can now be included in automated testing.

The story so far

Until now, AWS Security Agent had no way to receive verification codes or links sent by email. That meant applications relying on email-based MFA in their login flow were simply out of scope for automated penetration testing. TOTP (the one-time codes generated by an authenticator app) was already supported, but email-based MFA wasn't.

What changes

Applications that use email-based MFA can now be covered by automated penetration testing too. This should matter for:

  • Teams running apps that send a one-time code by email during login
  • Teams running apps that send a verification link by email during login
  • Services that mix TOTP and email-based MFA across different flows

Combined with the existing TOTP support, this gives you a single, unified way to test across multiple MFA methods.

Dive Deep

Here's how it works:

  • AWS Security Agent generates a unique forwarding address for each credential
  • You set up a forwarding rule with your own email provider so that your application's MFA emails get routed to that address
  • During a pentest, the agent automatically reads the forwarded message and submits the code or link to complete authentication

On the privacy side, no email account credentials are stored — the agent only ever reads the forwarded messages, not your inbox itself.

This is available in every AWS Region where AWS Security Agent is supported. You can find setup details on the AWS Security Agent product page and in the AWS Security Agent User Guide.

Wrap-up

  • AWS Security Agent (part of AWS Continuum) now supports pentesting applications with email-based MFA
  • Works via a unique forwarding address per credential, routed through a forwarding rule set up with your email provider
  • No email account credentials are stored, keeping the design privacy-conscious
  • Combines with existing TOTP support for unified testing across MFA methods
  • Available in all AWS Regions where AWS Security Agent is supported

If your team's login flow relies on email-based MFA, this closes a real gap in automated pentesting coverage!

Related posts