Reset Password Poisoning Via Host Header Injection Lead to (ATO)

Account Takeover

Hello Folks, My Methodology While doing Pentesting or bug hunting Depends on testing Auhthention functions like login, signup, and forget password before testing the core function of the application, the more common attack is Host Header Injection in reset password called reset password poisoning

So what is Host Header Injection (HHI)?

I explained Host Header Injection HERE

Host Header Injection Vulnerability arises from the Developer when Depending on the Host header which is used to help identify which back-end component the client wants to communicate with it like:

GET /blog HTTP/1.1

Host: 0xkourama.gitbook.io

In some cases, such as when the request has been forwarded by an intermediary system, the Host value may be altered before it reaches the intended back-end component.

Host Header Injection from portswigger

This scenario is based on the Forget Password process that sends an activation link and uses the value of the Host Header, So I will get the token of reset password on my server and reset its password for the victim to achieve the account takeover scenario

1. Inserted email for a victim like: [e-mail] in the reset password function

2. Intercepted the request and replaced the host with my burp collaborator

   1. HOST: burpcolaborator

3. When the victim clicked on the link I got the reset link with the token on my server

4. Then copy the URL include the token parameter and change the Victim password account.

1. Now Account takeover is done

Connect Me On LinkedIn: https://www.linkedin.com/in/yasserelsnbary/