Apprentice
← all rooms
Boss Expert

Boss: 0-Click ATO

Poison reset, predict token, own the account.

Mission briefing

VaultMail is the final boss: password reset links built from request headers and predictable tokens. You start with nothing but the victim's username and public reset flow. Complete a takeover without phishing the victim to click anything.

0 / 1 tasks 0 / 30 pts

Objectives

  • Complete the ATO boss chain
Task 1 Takeover Expert 30 pts

Scenario

VaultMail reset emails honour X-Forwarded-Host when building links, and reset tokens follow a guessable pattern. You know the victim username but they never click phishing links. Complete account claim without user interaction.

Your approach

  1. Request a reset for the victim with a poisoned forwarded host header.
  2. Derive or read the predictable token format from lab hints.
  3. Visit the claim endpoint with the victim token while hosting the evil reset domain if needed.
  4. Confirm takeover and read the boss flag.
  5. Submit the zero-click ATO flag.

Claim victim via reset chain.

Open lab →
Hint

Reset with X-Forwarded-Host. Token = tok-<user>- + MD5(user:hackerz-labs)[:8]