webProeasy
Lab 153 — FlowDesk — CSRF Account Takeover via Email Change
hackadvisor
Task: Express.js workspace platform where email change endpoint lacks CSRF protection while name/password endpoints are protected. Solution: exploited password reset token disclosure to take over admin account, or alternatively use CSRF via admin bot to change admin's email, then reset password and access admin panel for flag.
$ ls tags/ techniques/
information_disclosureexpresscsrfadmin_botdecoy_flagaccount_takeoverpassword_reset_token_leaksamesite_laxmissing_csrf_tokenemail_change
admin_account_takeoverdecoy_flag_evasionsamesite_lax_top_level_navigationcsrf_on_email_change_endpointpassword_reset_token_disclosureform_urlencoded_csrf
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 110 — FlowDesk — Mass Assignment Privilege Escalation— hackadvisor
- [web][Pro]Lab 118 — FlowDesk — Predictable Password Reset Token— hackadvisor
- [web][Pro]Lab 192 — StockFlow — Broken Authentication via CSRF Token Reuse— hackadvisor
- [web][Pro]DeskFlow — Session Fixation via Support Ticket URL— hackadvisor
- [web][Pro]Lab 233 — PulseAPI — Regex Auth Bypass via Query String Injection— hackadvisor