Oct 4, 2023 08:08 PM
(This post was last modified: Oct 5, 2023 03:37 PM by curl.)
1. Try CRLF injection
2. Adding your emails
3. Token Issue
- Check if the token is reflected back in the response
- Use another email's token on your victim's reset link reset/[email protected]?token=*attacker's token
- Check for brute forcing
- Try used tokens
- Try giving massive tokens
- Remove the token and check
4. Change Headers
Quote:Add 'X-Forwarded-Host: attacker.com' (Host Header Injection)
Quote:Host: Attacker.com
DO NOT DEAL WITH THIS MEMBER
(Oct 4, 2023 08:08 PM)curl Wrote: 1. Try CRLF injection
2. Adding you emails
3. Token Issue
- Check if the token is reflected back in the response
- Use another email's token on your victim's reset link reset/[email protected]?token=*attacker's token
- Check for brute forcing
- Try used tokens
- Try giving massive tokens
- Remove the token and check
4. Change Headers
sounds gay boi
How is this method used? Also, which providers can it be used on besides Mail.com?
Do you want to track someone's location? If your answer to this question is affermative, click here.
Oct 5, 2023 03:21 PM
(This post was last modified: Oct 5, 2023 03:28 PM by curl.)
(Oct 5, 2023 06:25 AM)SIM-4574945 Wrote: How is this method used? Also, which providers can it be used on besides Mail.com?
The domain I put is just an example, you would use your own domain/email for 'attacker' and you would use the victims information for the 'victims'
These are penetration testing methods for those who are already intermediate enough to know which endpoints to target and how to intercept/modify/repeat requests.
(Oct 5, 2023 03:21 PM)curl Wrote: The domain I put is just an example, you would use your own domain/email for 'attacker' and you would use the victims information for the 'victims'
These are penetration testing methods for those who are already intermediate enough to know which endpoints to target and how to intercept/modify/repeat requests.
OK, but I assume that this vulnerability is not present in popular e-mail providers such as Gmail, Yahoo and the like. Is that correct?
Do you want to track someone's location? If your answer to this question is affermative, click here.
(Oct 6, 2023 02:53 AM)SIM-4574945 Wrote: OK, but I assume that this vulnerability is not present in popular e-mail providers such as Gmail, Yahoo and the like. Is that correct?
the vulnerability has nothing to do with mail providers lol it has everything to do with the security foundation of whatever website you are pentesting.
(Oct 7, 2023 10:03 AM)curl Wrote: the vulnerability has nothing to do with mail providers lol it has everything to do with the security foundation of whatever website you are pentesting.
OK, thanks for the clarification. I am a neophyte, so I don't particularly know about pentesting. I have a very rough knowledge on the subject.
Do you want to track someone's location? If your answer to this question is affermative, click here.
(Oct 7, 2023 11:27 AM)SIM-4574945 Wrote: OK, thanks for the clarification. I am a neophyte, so I don't particularly know about pen-testing. I have a very rough knowledge on the subject. It might be better to not skip the beginners tutorials on the subject, I recommend starting at the absolute bottom material before jumping to more intermediate methods. Thus you'd have a better understanding of when to apply these methods or if it is even worth it.
Tryhackme website, Hackthebox website, Nahamsec on youtube , are all good resources to use.
(Oct 7, 2023 07:21 PM)curl Wrote: It might be better to not skip the beginners tutorials on the subject, I recommend starting at the absolute bottom material before jumping to more intermediate methods. Thus you'd have a better understanding of when to apply these methods or if it is even worth it.
Tryhackme website, Hackthebox website, Nahamsec on youtube , are all good resources to use.
I thank you for your suggestions. You are very kind. May I ask you if previous knowledge of programming languages, such as PHP, HTML and others, is required to do these methods?
Do you want to track someone's location? If your answer to this question is affermative, click here.
(Oct 8, 2023 03:44 PM)SIM-4574945 Wrote: I thank you for your suggestions. You are very kind. May I ask you if previous knowledge of programming languages, such as PHP, HTML and others, is required to do these methods?
I think it is very helpful to understand the language in which you are trying to find flaws in.
|
