Thread by @harshbothra_

#learn365 Day-22: Password Reset Token Issues

1. Weak Cryptography in Password Reset Tokens
- Always check randomness in password reset tokens. It is also a good idea to check password reset tokens against known schemes.
Ref: medium.com/bugbountywrite…
#bugbountytips
(1/n)

(2/n)
2. Reusable Password Reset Tokens
- Use the token once and try to re-use it again.
- Request a new token and try if the old one is still active.
- Check how long a token stays alive. If it's >1 day and is reusable, you may report it.

(3/n)
3. IDOR (ATO)
- In the password reset link, assume there is something like this:
harshbothra.tech/reset?token=so…
- try changing the value of the user parameter to the victim and see If the attack token can be used for resetting the victim's password.
harshbothra.tech/reset?token=so…

(4/n)
4. Lack of Random Generation in Password Reset Token
- Request multiple passwords reset tokens.
- If all the requested tokens are identical, it is confirmed that some Identifier is crypted to generate a password reset token.
- Try guessing the crypto else still an issue.

(5/n)
5. Weak/Small Password Reset Token is used
- If a password reset token used by the application is weak/small/guessable, it can be brute-forced.

(6/n)
6. Password Reset Token not Validated
- Navigate to the password reset link and remove the token parameter or send only empty values.
- Only keep the user identifier and change that to the victim user's identifier
- See if it is possible to change the password.

(7/n)
7. Excessive Information in JWT Based Password Reset Token

- If the password reset token is JWT Based, check for the following:
a. If there is any excessive info, it may contain an old password (never seen but you never know)
b. Make sure that asymmetric algo is used.

(n/n)

Some of the Broken Cryptography & Account Takeover Related methods are discussed in some of my talks, you can find them here:

Youtube:
Speakerdeck: speakerdeck.com/harshbothra/br…