---
description: >-
  https://portswigger.net/web-security/authentication/other-mechanisms/lab-password-reset-broken-logic
---

# Password reset broken logic

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FsNgfOkd0ry4ktg77i4e5%2F1.png?alt=media&#x26;token=eb889db3-bb32-4d4b-89ed-dea36e11fbf6" alt=""><figcaption></figcaption></figure>

Let's click on `My account`.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FALDPjh3YcjCcnAdRNap5%2F2.png?alt=media&#x26;token=5dc8cab7-7c04-408d-a8c9-d41458ca7ad7" alt=""><figcaption></figcaption></figure>

Click on `Forgot password?`. Then enter the `wiener` username.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FF8BWLwKAr8SzRx1RMmr7%2F3.png?alt=media&#x26;token=5e6b893b-18fe-4401-b907-277d7cc72220" alt=""><figcaption></figcaption></figure>

Next, we have to click on `Email client` in order to check our emails.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2Fyhy36FjBw1j5W1ZqTTIg%2F5.png?alt=media&#x26;token=f8242eb8-b813-4c85-8586-84ad448c13a3" alt=""><figcaption></figcaption></figure>

Let's click on the link provided to us to reset our password.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FthpBe4szbSAhlmHuiqAE%2F6.png?alt=media&#x26;token=b2f93884-d5f7-47ae-9443-99b1443ac140" alt=""><figcaption></figcaption></figure>

We can enter any password. Since we are proxying the traffic through Burp Suite, we can view this request in the `Proxy > HTTP History` tab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FTHQDCHLglHOH56i5rYBb%2F7.png?alt=media&#x26;token=aafd6692-7bb6-45b5-97af-76ac945c7d51" alt=""><figcaption></figcaption></figure>

We can forward this request to the `Repeater` so that we can modify it.&#x20;

Once in the `Repeater` tab, let's remove the `temp-forgot-password-token` parameter from the URI as well as the POST data field and send the request to the server.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FMeVvJ1XAmWilEetfIOyc%2F8.png?alt=media&#x26;token=fd7ab9a9-1aef-46fd-9c5b-f610f638afd7" alt=""><figcaption></figcaption></figure>

We can see that our password has been changed even though we did not include the token, This means that the server sets the token but does not validate it.

Let's set the `username` field to the following and resend the request:

```
carlos
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FrZQjvNZchVaSRGGsrIg8%2F9.png?alt=media&#x26;token=be54658c-fca4-4eb2-a10e-021f67b79312" alt=""><figcaption></figcaption></figure>

Now we can login using the following credentials:

| Username | Password |
| -------- | -------- |
| carlos   | password |

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2Ftw21lmU2YxpTzmFp5f4Q%2F11.png?alt=media&#x26;token=b6116046-dbcf-476a-acae-1e29caacc59b" alt=""><figcaption></figcaption></figure>

We have solved the lab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FAJYtTKPG0eh40CsZUdzj%2F12.png?alt=media&#x26;token=6db8a413-2906-4d28-aec7-0e3d1f2e4f69" alt=""><figcaption></figcaption></figure>
