# LAB #04 Basic password reset poisoning

## **Lab Overview**

This lab is vulnerable to password reset poisoning. The user `carlos` will carelessly click on any links in emails that he receives. To solve the lab, log in to Carlos's account.

You can log in to your own account using the following credentials: `wiener:peter`. Any emails sent to this account can be read via the email client on the exploit server.

## **Exploitation**

### #1 Analysing Password Reset

On login page we can see a "Forgot your password?" functionality. and reset the password.

![](https://cdn.hashnode.com/uploads/covers/69eb0c2b1e45c4e0da9bea4a/a09d7c0e-45fa-4222-bd6a-e0150f54d8fe.png align="center")

Enter the Username.

![](https://cdn.hashnode.com/uploads/covers/69eb0c2b1e45c4e0da9bea4a/852ed2fe-85c8-4c7c-b9b4-6d293d0886cc.png align="center")

We will get a password reset link in our email.

![](https://cdn.hashnode.com/uploads/covers/69eb0c2b1e45c4e0da9bea4a/683fe880-d7c7-41ad-99eb-529a3e4c21d1.png align="center")

Click the link and reset the password.

![](https://cdn.hashnode.com/uploads/covers/69eb0c2b1e45c4e0da9bea4a/7f307b77-f3b1-4544-91a9-f37838a80cca.png align="center")

In Burp HTTP history we can find the `POST /forgot-password` request.

![](https://cdn.hashnode.com/uploads/covers/69eb0c2b1e45c4e0da9bea4a/e6a52a91-1442-439e-9b47-04c0bbf683bf.png align="center")

This request is used to trigger the password reset email. This contains the username whose password is being reset as a body parameter.

### #2 Testing Host Header Injection

Now send that request to repeater.

![](https://cdn.hashnode.com/uploads/covers/69eb0c2b1e45c4e0da9bea4a/60d3dd2e-8feb-493e-910f-2d0a4dfb1fae.png align="center")

Change the `Host` header to any value and send the password reset request

![](https://cdn.hashnode.com/uploads/covers/69eb0c2b1e45c4e0da9bea4a/404cc305-8bf0-427c-ac8a-5b878f8f18e5.png align="center")

Open the new password reset email.

![](https://cdn.hashnode.com/uploads/covers/69eb0c2b1e45c4e0da9bea4a/766c1e9c-92fb-4b2e-a27e-0553f214e92f.png align="center")

We can see that the reset link uses the modified `Host` header instead of the original domain.

### #3 Stealing Carlos's Reset Token

Now change the `Host` header to your exploit server's domain.

![](https://cdn.hashnode.com/uploads/covers/69eb0c2b1e45c4e0da9bea4a/42f9bba4-be92-448b-8442-484ea7f62057.png align="center")

Change the username to `carlos` and send the request.

Go to access log and copy Carlos reset token.

```plaintext
temp-forgot-password-token=9uomlgp4hb5otpa18jih8noryoxjcmpx
```

Copy the password reset link from your first email and replace the reset token in the URL with Carlos's reset token.

```plaintext
https://0acf008f043d08d680582bef0039004e.web-security-academy.net/forgot-password?temp-forgot-password-token=9uomlgp4hb5otpa18jih8noryoxjcmpx
```

### #4 Resetting Password and Verifying Access

Open the modified URL in the Browser and reset Carlos's password.

![](https://cdn.hashnode.com/uploads/covers/69eb0c2b1e45c4e0da9bea4a/534a7710-9051-4df0-bcaf-4686429f0d3c.png align="center")

Now login as Carlos.

![](https://cdn.hashnode.com/uploads/covers/69eb0c2b1e45c4e0da9bea4a/7337dc14-6a46-42df-ad74-6261f4ad6068.png align="center")

![](https://cdn.hashnode.com/uploads/covers/69eb0c2b1e45c4e0da9bea4a/9a0b4577-d130-48a4-b40b-90531348f2a7.png align="center")

Successfully logged in as Carlos!

![](https://cdn.hashnode.com/uploads/covers/69eb0c2b1e45c4e0da9bea4a/dab52c10-c610-4099-9ae9-e25f6d8358c4.png align="center")

### \# And That’s a Wrap

Password reset functionality should be tested carefully, as improper handling of the `Host` header can allow attackers to steal reset tokens and take over user accounts.