> For the complete documentation index, see [llms.txt](https://sayonara.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sayonara.gitbook.io/writeups/portswigger/http-host-header-attacks/basic-password-reset-poisoning.md).

# Basic password reset poisoning

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FRAoP3WhD9W8q9AGbnNee%2Fimage.png?alt=media&amp;token=7a43dac5-41ad-462e-9123-63ee9d79ebc8" alt=""><figcaption></figcaption></figure></div>

## <mark style="color:red;">Exploitation :</mark>&#x20;

the first thing we have to map all the site and browse all functionnalities of the website after doing this we will find out a reset password functionnality in the logging by clicking on the <mark style="color:blue;">Forget password?</mark>

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FXDxdV3oh7zCKcetu7H5m%2Fimage.png?alt=media&amp;token=b2580ac7-f302-49f1-bbd7-0010c050370f" alt=""><figcaption></figcaption></figure></div>

The login form contains a `Forgot password?` functionality. I use it to request a pass reset for my user `wiener`.

This results in an email that is sent to my address, containing a reset link:&#x20;

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2Fth614ucDy5xOB8o2ZdMG%2Fimage.png?alt=media&amp;token=1b54483a-bfd1-41ad-9972-0320cb178ca8" alt=""><figcaption></figcaption></figure></div>

now let's try to send a reset link to our user wiener but this we will intercept the request and modify the `Host` header value and see if this value is reflected on the reset link

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FUHhxcaE97qcQRmJxXxwx%2Fimage.png?alt=media&amp;token=d331a41c-8d92-4819-9ea5-93abc2142bd6" alt=""><figcaption></figcaption></figure></div>

The password reset link contains a link to the domain specified in the `Host` header:

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FM3CXpGQLRkhfEg1FSFuO%2Fimage.png?alt=media&amp;token=747c76dd-039c-48e3-82d2-3fbe15195937" alt=""><figcaption></figcaption></figure></div>

so our goal now is to send the password reset link of the user carlos to a server that we control by manipulating the `Host` header and then take the password reset link and use it to change the password of  the user carlos and takeover his account

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2F7DsOA1B4MrMhJgiS3WIT%2Fimage.png?alt=media&amp;token=16db96eb-2ec8-4a8d-a0a4-7dda782426fe" alt=""><figcaption></figcaption></figure></div>

to do that we will use the lab exploit server

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FnDn8ciJV2haNFHCB9Eu6%2Fimage.png?alt=media&amp;token=590c47ec-8aa7-47f4-b369-6d9b66e11c05" alt=""><figcaption></figcaption></figure></div>

enter the username carlos and intercept the request using burp

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FNWbjxlPReXyQWMWEVGsm%2Fimage.png?alt=media&amp;token=c0a6f4f3-c546-4f23-aa8c-c0f82577fa47" alt=""><figcaption></figcaption></figure></div>

change the host header to our server

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FgmHoyWHotuk21hder8cH%2Fimage.png?alt=media&amp;token=be0465e9-1ff6-436f-9778-ad0985785465" alt=""><figcaption></figcaption></figure></div>

according to the lab description the user carlos clicks on links that he recieves blindly so he will click on the password reset link that is issued by our server so if we access the server logs we can see the password reset link

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2Fzlkh5G2hasga38Gyj0rg%2Fimage.png?alt=media&amp;token=2c420ad6-5cad-4a49-b056-254e041c7106" alt=""><figcaption></figcaption></figure></div>

take this link and copy it in the browser and it will tell you to type new password for carlos after this logging as the user carlos using the password you typed and the challenge is solved

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FMnDYQWbl5cKuxRaEJzgH%2Fimage.png?alt=media&amp;token=cac7c83d-460d-4798-8f36-96f247b35881" alt=""><figcaption></figcaption></figure></div>

hope you found this walkthrough easy to understand and follow

Greeting From [<mark style="color:red;">**Sayonara**</mark>](https://github.com/ismail-arame)