> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/web/host-header/password-reset-poisoning-via-dangling-markup.md). # Password Reset Poisoning via Dangling Markup Password Reset Poisoning via Dangling Markup notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context. ### Password Reset Poisoning via Dangling Markup **Description of lab** This lab is vulnerable to a **password reset poisoning via dangling markup**. / By using the wrong HTML management in the reset email, it is possible to divert the link sent to a user and retrieve his new password. **Objective:** log in to **carlos account**. **Credentials provided:** * User: `wiener` * Password: `peter`

All emails can be viewed via the email client of the operating server\*\*.

**Observation initiale** A password reset feature is available. / After the request, an HTML email is sent with the following content: {% code overflow="wrap" %} ```http

Hello!

Please click here to login with your new password: AGSoZyzfot

Thanks,
Support team

This email has been scanned by the MacCarthy Email Security service ``` {% endcode %} The connection link is built dynamically from the **Host** header of the query. **Behavioral analysis** If you change the Host header to include an arbitrary port: ```http Host: 0a2e00ee040867fe812cd4f900e700cb.web-security-academy.net:1234 ``` The port is correctly reflected in the email received. / This confirms that the value of **Host** is embedded without strict validation in the HTML of the email.

**Exploitation via dangling markup** A Host value containing an apostrophe is then injected, thus breaking the HTML attribute: ```http Host: 0a2e00ee040867fe812cd4f900e700cb.web-security-academy.net:1234'HELLOO ``` The content is interpreted by the email client, which indicates a usable HTML injection.

**Payload final** This behavior is exploited by opening a `` tag without closing it properly, so that the rest of the email content (including the password) is interpreted as part of the URL: ```http Host: 0a2e00ee040867fe812cd4f900e700cb.web-security-academy.net:1234'

**Result** When email is generated and sent to **carlos**, the email client interprets the injected HTML. / The new password is then included in the URL and transmitted automatically to the operating **server**. Carlos' password is retrieved from the server logs, which allows you to log in to his account and validate the lab.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/web/host-header/password-reset-poisoning-via-dangling-markup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.