Handling SMS Verification

Aikido supports SMS-based verification for authenticated pentests by provisioning a dedicated phone number for your authentication set.

Use this feature if your application requires:

• SMS 2FA / MFA: A text message code is required after entering username/password.

#How it works

In the Test User modal, Aikido can create a phone number for your project. You use that number in your login flow, and include it in your instructions with the <phone_number> placeholder.

You can open View Messages at any time to inspect incoming SMS messages and quickly copy detected verification codes.

#Setup Guide

1. 1

   Select the SMS Authentication Method

   When adding a test user, choose Username & Password + SMS Verification.

2. 2

   Create a Phone Number

   In the SMS Phone Number section:

   1. Click Create Phone Number.
   2. Copy the generated number.

   

3. 3

   Use the Number in Your App

   Configure your test user so SMS verification codes are sent to the generated number.

4. 4

   Update Authentication Instructions

   Use explicit, step-by-step instructions and include <phone_number> where relevant.

   Example Instruction:

   1. Navigate to https://app.example.com/login
   2. Enter username: pentest_user
   3. Enter password: super_secure_password
   4. Click "Log In"
   5. Wait for an SMS verification code sent to +1234567890
   6. Enter the SMS code and click "Verify"

5. 5

   Watch Incoming Messages

   Click View Messages to open the SMS inbox:

   • Messages appear in real time.
   • If a numeric code is detected, use Copy Code for quick input/testing.

   

6. 6

   Test the Configuration

   1. Click Save & Test.
   2. The agent runs the login flow, including the SMS verification step.
   3. Confirm it reaches the authenticated state.

#Troubleshooting

• No SMS received: Confirm your app sends codes to the exact generated number and that the test user profile is updated.
• Placeholder not replaced: Use the exact token <phone_number> in your instructions.
• Could not create phone number: Check wallet balance, creating phone numbers is for free but requires you to have enough credits in your wallet to avoid abuse.