password-reset-poisoning

What problem does it solve?

This Skill helps penetration testers exploit vulnerabilities in password reset functionalities to gain unauthorized access to user accounts.

Core Features & Use Cases

• Host Header Poisoning: Manipulate Host headers to redirect reset tokens to an attacker-controlled domain.
• Token Leakage: Exploit Referer headers or email injection to intercept reset tokens.
• Token Analysis: Identify weak or predictable tokens for brute-force attacks.
• Use Case: A penetration tester uses this Skill to exploit a web application's weak password reset flow, successfully intercepting a reset token via Host header poisoning and taking over a victim's account.

Quick Start

Use the password-reset-poisoning skill to test for host header poisoning vulnerabilities against the target URL 'https://example.com/reset'.