Broken Authentication Brute-Forcing Password Reset Tokens
any hint
i try ffuf -w ./tokens.txt -u http://83.136.255.40:41881/reset_password.php?token=FUZZ -fr “The provided token is invalid”
this code not solve and try again to generata another It didn’t help me either.
Hello, i believe you are doing everything correctly. Try using the token on via the url rather than the password reset button.
eg: target.com/reset)=?token=value
i try it and i get the pass reset but i dont know the next step Did you specify a username when resetting the password?
Yes,the user admin exists. so i used admin as the user. Once you have reset the password, you ill have to login with the set password
You mean I can log in with what I wrote in the password field in Burp and the username is admin
Yes, exactly
