Lab 118 — FlowDesk — Predictable Password Reset Token

hackadvisor

Task: FlowDesk project management SaaS with password reset feature generating tokens as MD5(unix_timestamp). Solution: triggered reset for own account, discovered token = MD5(timestamp) via local mailbox, predicted admin reset token by timestamp, took over admin account, retrieved flag from admin settings.