LAB #04 Basic password reset poisoning

Lab Overview

This lab is vulnerable to password reset poisoning. The user carlos will carelessly click on any links in emails that he receives. To solve the lab, log in to Carlos's account.

You can log in to your own account using the following credentials: wiener:peter. Any emails sent to this account can be read via the email client on the exploit server.

Exploitation

#1 Analysing Password Reset

On login page we can see a "Forgot your password?" functionality. and reset the password.

Enter the Username.

We will get a password reset link in our email.

Click the link and reset the password.

In Burp HTTP history we can find the POST /forgot-password request.

This request is used to trigger the password reset email. This contains the username whose password is being reset as a body parameter.

#2 Testing Host Header Injection

Now send that request to repeater.

Change the Host header to any value and send the password reset request

Open the new password reset email.

We can see that the reset link uses the modified Host header instead of the original domain.

#3 Stealing Carlos's Reset Token

Now change the Host header to your exploit server's domain.

Change the username to carlos and send the request.

Go to access log and copy Carlos reset token.

temp-forgot-password-token=9uomlgp4hb5otpa18jih8noryoxjcmpx

Copy the password reset link from your first email and replace the reset token in the URL with Carlos's reset token.

https://0acf008f043d08d680582bef0039004e.web-security-academy.net/forgot-password?temp-forgot-password-token=9uomlgp4hb5otpa18jih8noryoxjcmpx

#4 Resetting Password and Verifying Access

Open the modified URL in the Browser and reset Carlos's password.

Now login as Carlos.

Successfully logged in as Carlos!

# And That’s a Wrap

Password reset functionality should be tested carefully, as improper handling of the Host header can allow attackers to steal reset tokens and take over user accounts.