Apprentice
← all rooms
Auth Abuse Hard

Auth Abuse

Host-header reset poisoning and a 2FA skip endpoint.

Mission briefing

AccountSafe handles password resets and step-up two-factor login for a fintech app. Reset emails build links from incoming host headers, and OTP checks have a shortcut path. Explore whether authentication flows can be nudged off the happy path.

0 / 2 tasks 0 / 25 pts

Objectives

  • Poison reset links
  • Skip 2FA
Task 1 Reset poisoning Medium 10 pts

Scenario

AccountSafe emails password reset links built from the incoming Host header. The message shows whatever host the client supplied in forwarded headers. Make the reset link point at evil.example instead of the real site.

Your approach

  1. Request a password reset for a demo account through the lab form.
  2. Replay the request with X-Forwarded-Host set to evil.example.
  3. Read the generated reset link in the lab preview output.
  4. Verify the link domain matches your injected host.
  5. Submit the host-header poisoning flag.

Make the reset link point at evil.example.

Open lab →
Hint

X-Forwarded-Host: evil.example

Task 2 2FA bypass Hard 15 pts

Scenario

After password login, users must enter a one-time code—unless they know a shortcut URL. An internal skip endpoint completes login without verifying the code. Access the protected area as victim without the OTP.

Your approach

  1. Log in as victim with the provided password to reach the OTP step.
  2. Browse or fuzz auth paths for a skip or bypass route.
  3. GET the skip endpoint while the partial session is active.
  4. Confirm you reach the authenticated area and see the bypass flag.
  5. Submit the 2FA skip flag.

Login as victim/victim then skip OTP.

Open lab →
Hint

After login, hit /labs/auth/2fa/skip