Attackers won't ask you to turn off login controls.
Your security test shouldn't either.
Hound can complete MFA and CAPTCHA.
Gatehouse is a small customer portal with MFA, CAPTCHA, and a protected page. Hound completed MFA on its own, then requested operator assistance for CAPTCHA inside the agent's browser session.
01
Hound completes MFA
The agent checks its inbox for the MFA code and completes the form.
02
Operator solves CAPTCHA
The agent recognizes CAPTCHA and requests operator assistance.
03
Hound keeps going
The agent resumes control of the authenticated session.
Hound supports both email and SMS MFA.
screenshot of the operator's view

Show the signed-in surface reached+

Gatehouse is public. View the source on GitHub.