Lab 206 — PulseBoard — Password Reset Token Leakage via Referrer

hackadvisor

Task: PulseBoard analytics dashboard with password reset and public referrer feed. Solution: Trigger admin password reset, then harvest the leaked reset token from the public referrer analytics feed — the same-origin tracking pixel on the reset page causes the browser to send the full URL (including token) in the Referer header.