A_box4·Nov 1Authentication Bypass via Password Reset Flow Manipulationقَالُوا سُبْحَانَكَ لَا عِلْمَ لَنَا إِلَّا مَا عَلَّمْتَنَا ۖ إِنَّكَ أَنتَ الْعَلِيمُ الْحَكِيمُ
Samadhan shimple·Oct 22I Found a Password Reset Token Flaw in My Bug Bounty Testing , But My Report Was Marked as a…
BugWraith (Lokesh)·Aug 30I sent one HTTP request and hijacked a password reset link → ATOA single “redirect” parameter, an attacker-controlled Collaborator domain, and a full account takeover. Welcome to another password reset…A response icon1A response icon1
Given Quincy·Jul 27HACKING JULY DAY 22: VULN-BANK EXPLOITATION #6Apologies for not being able to post on Saturday due to unavoidable circumstances.
TheRealIbk·Jul 17VulnBank: Using Exposed API Docs and Weak Reset Logic to gain Superadmin AccessExposed API endpoints are often the starting point for dangerous information leaks. In this write-up, I will demonstrate how a weak…
Ethical Hacker·Jun 30Password Reset Broken LogicSuccessfully solved the Password Reset Broken Logic lab from PortSwigger Web Security Academy. This repository contains a professional…
InLevel Up CodingbyHafiq Iqmal·Jun 243 Ways to Design a Password Reset Flow. Most Teams Only Know One.How each approach works, what it protects against, and when to reach for which one.
Dr Ridox·Jun 1Password Reset Token Leakage via Host Header Poisoning (Real Bug Bounty Case Study)Introduction
Nelson Njuguna·Mar 25How I Turned Password Resets From a Nightmare Into a Win“Hi IT, I forgot my password. Can you reset it?”
