Handling SMS Verification

Aikido supports SMS-based verification for authenticated pentests by provisioning a dedicated phone number for your authentication set.

Use this feature if your application requires:

• SMS 2FA / MFA: A text message code is required after entering username/password.

If your app uses authenticator apps, use TOTP setup.

If your app sends codes via Email, use the Email Verification feature.

How it works

In the Test User modal, Aikido can create a phone number for your project. You use that number in your login flow, and include it in your instructions with the <phone_number> placeholder.

You can open View Messages at any time to inspect incoming SMS messages and quickly copy detected verification codes.

Setup Guide

1

Select the SMS Authentication Method

When adding a test user, choose Username & Password + SMS Verification.

2

Create a Phone Number

In the SMS Phone Number section:

1. Click Create Phone Number.

2. Copy the generated number.

3

Use the Number in Your App

Configure your test user so SMS verification codes are sent to the generated number.

4

Update Authentication Instructions

Use explicit, step-by-step instructions and include <phone_number> where relevant.

Example Instruction:

1. Navigate to https://app.example.com/login
2. Enter username: pentest_user
3. Enter password: super_secure_password
4. Click "Log In"
5. Wait for an SMS verification code sent to [phone]
6. Enter the SMS code and click "Verify"

5

Watch Incoming Messages

Click View Messages to open the SMS inbox:

• Messages appear in real time.

• If a numeric code is detected, use Copy Code for quick input/testing.

6

Test the Configuration

1. Click Save & Test.

2. The agent runs the login flow, including the SMS verification step.

3. Confirm it reaches the authenticated state.

Troubleshooting

• No SMS received: Confirm your app sends codes to the exact generated number and that the test user profile is updated.

• Placeholder not replaced: Use the exact token <phone_number> in your instructions.

• Could not create phone number: Check wallet balance, creating phone numbers is for free but requires you to have enough credits in your wallet to avoid abuse.