Portswigger writeup - Password reset Broken Logic

Lab: Password reset broken logic

In this lab, we’ll bypass the “Forgot password” feature to get access on Carlos’s account.

1. On the home page, click “My account

   

2. Next page, click “Forgot password”

   

3. To get Wiener’s email address, click “Email client”

   

4. In the new open tab, copy Wiener’s email address

   

5. Go back to the previous tab, paste the email address and click “Submit”

   

6. Go to the email client and refresh the page, a new email appears. Click the link

   

7. In the new open page, type and confirm a password and click “Submit”

   

8. On Burp, in Proxy > HTTP History, find the POST reset that contains twice the “temp-forgot-password-token” (at the top and after “connection close”) and send it to Repeater

   

9. Delete the 2 tokens and replace “wiener” with “carlos”

   

10. When it’s done, send the reset, you get a 302 response

    

11. Go back to the lab and click “My account”

    

12. Enter Carlos’s credentials (still “peter” in this example, adapt if you have chosen something else) and click “Submit”

    

13. Carlos’s username and email address appear, the lab is solved