OWASP Hunting
Authentication & Authorization

Password Reset Vulnerabilities

Password reset flaws allow account takeover through host header injection, predictable tokens, response manipulation, and token leakage.

These payloads are for authorized testing only — systems you own, authorized bug bounty programs, or controlled lab environments. Unauthorized testing is illegal.

What it is

Password reset vulnerabilities arise when the password reset flow can be abused to take over another user's account. Common issues include host header injection (causing reset link to be sent to attacker-controlled domain), predictable or reusable reset tokens, token leakage via Referer headers, and response manipulation to bypass the verification step.

Attack Vectors

  • Password reset request forms
  • Reset link generation logic
  • Token validation endpoints
  • Account recovery flows

Testing Methodology

  1. Inject attacker-controlled host in Host header during password reset request
  2. Request a reset token for a victim account and check if it arrives in attacker's server logs (via Referer or analytics)
  3. Test if reset tokens expire or are single-use
  4. Intercept the response and manipulate status/success fields
  5. Check for user enumeration in reset email responses

Payloads

Reference payloads for authorized testing. Always verify you have permission before use.

Host Header Injection
Host: attacker.comHost: target.com X-Forwarded-Host: attacker.comX-Forwarded-Host: attacker.comX-Host: attacker.com
Token Manipulation
token=aaaaaaaaaaaaaaaa (predictable)token=victim_token_heretoken= (empty)token[]=array_value
Response Manipulation
{"status": "success"}{"verified": true, "redirect": "/dashboard"}

Indicators of Vulnerability

  • Reset link received on attacker-controlled domain via host header injection
  • Token accepted multiple times or after expiry
  • Account takeover demonstrated by resetting victim's password

Detection Guidance

Validate Host header against allowlisted domains. Monitor for password reset tokens used more than once. Alert on password resets for high-privilege accounts.

Mitigation & Remediation

  • Validate Host header against a configured allowlist when generating reset links
  • Use cryptographically random, single-use, time-limited tokens
  • Invalidate tokens immediately after use
  • Return identical responses for existing and non-existing accounts to prevent enumeration
  • Rate-limit password reset requests

References

Responsible Use

All content in this reference is for authorized security testing only. Use only on systems you own or have explicit written permission to test.

  • Systems and applications you own
  • Authorized penetration testing engagements
  • Bug bounty programs with defined scope
  • Educational lab environments (DVWA, WebGoat, HackTheBox)