[albozkar]

uploaded the vid on youtube lol https://youtu.be/Sm_tymMHkxI
hope i won't get banned
feel free to use this to hack accounts (can't hack mfs with 2fa)

[ItachiUchiha]

uploaded the vid on youtube lol https://youtu.be/Sm_tymMHkxI
hope i won't get banned
feel free to use this to hack accounts (can't hack mfs with 2fa)

Offscreen: Reset a password reset, and capture the valid response.
Onscreen: Show that you just requested the password reset. Slap that valid response that was captured in the first step and voila, you're a hax0r.

That password reset link is bound to accounts.

[albozkar]

Holy shit this is fake.

This is literally a glorified inspect element.

You change the failed response to a response you already had in your little textdocument.

why don't you try it yourself first.

[PurpleMoss]

Not completely implausible but something that would need looking into more. Response manipulation is an attack that's out there. The code that is emailed to the user is checked against the server and if valid, allows the next step, in this case the check comes back as invalid yet feeding the browser with a valid response could just skip that all together and display the next step.