VaultMail — 0-Click ATO

Scenario

VaultMail reset emails honour X-Forwarded-Host when building links, and reset tokens follow a guessable pattern. You know the victim username but they never click phishing links. Complete account claim without user interaction.

Your approach

1. Request a reset for the victim with a poisoned forwarded host header.
2. Derive or read the predictable token format from lab hints.
3. Visit the claim endpoint with the victim token while hosting the evil reset domain if needed.
4. Confirm takeover and read the boss flag.
5. Submit the zero-click ATO flag.