Apprentice
← back to room
Auth Abuse

Password Reset Poisoning

Scenario

AccountSafe emails password reset links built from the incoming Host header. The message shows whatever host the client supplied in forwarded headers. Make the reset link point at evil.example instead of the real site.

Your approach

  1. Request a password reset for a demo account through the lab form.
  2. Replay the request with X-Forwarded-Host set to evil.example.
  3. Read the generated reset link in the lab preview output.
  4. Verify the link domain matches your injected host.
  5. Submit the host-header poisoning flag.
Request a reset. The link is built from the Host / X-Forwarded-Host header. Send X-Forwarded-Host: evil.example (Burp) or use the helper below.