Abusing HTTP Misconfigurations

[ej0573208]

Abusing HTTP Misconfigurations Skills Assessment - Easy anyone to help me i can’t bypass the password reset function

[ej0573208]

++++++++++++++++++ please anyone to help me

[cherryeater]

Hi!
Did you follow it?

Abusing http misconfigurations

You will need to attempt to access the Admin area with the provided credentials . You will need to have two tabs open. Then you can test the forms found at login (in the second tab) to determine which will get you admin area access. Don’t overthink it and it can be done with two browser tabs open.

[ej0573208]

okey i figured it out i am in hard skill assesment

[blizco]

I’m stuck on the easy skills assessment. I don’t get your hint. I tried to open 2 tabs in Firefox (with and without Burb etc.) and tried all the possibilities. No success.

[krellkrypto]

For future people looking. You will need to login with the given account. There is somthing you can interact with on the site that will allow you to puzzle the session varible correctly

[chempenois]

I found several extra endpoints on the website and tried to use them, bypassing the default page. That is, I would complete the first step of reset or register, and then copy a non-default page url into the browser. However, this was to no luck and would go back to login. Was the useful thing on the signed-in version for the website not an endpoint?

[chempenois]

K I figured it out. The advice on having two tabs open was good. A user must be logged in while the login forms are being manipulated.