webProeasy
Lab 408 — MailNest — Broken Authentication via Unauthenticated Password Reset
hackadvisor
Task: Express.js email marketing platform with publicly accessible API docs revealing a force-reset-password endpoint with no authentication. Solution: Enumerate API endpoints via /api/v1/docs, reset admin password via unauthenticated force-reset-password, login as admin, retrieve flag from admin config.
$ ls tags/ techniques/
nodejsnginxexpressapi_securitypassword_resetdecoy_flagaccount_takeoverunauthenticated_accessbroken_authenticationadmin_endpointhackadvisorforce_reset_passwordapi_documentation_disclosure
broken_access_controladmin_account_takeoverapi_endpoint_enumerationdecoy_flag_recognitionapi_documentation_disclosureunauthenticated_password_reset
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 293 — CloudNest — Reflected XSS in Login Callback Label— hackadvisor
- [web][Pro]Lab 328 — DataNest — NoSQL Operator Injection in Authentication— hackadvisor
- [web][Pro]Lab 153 — FlowDesk — CSRF Account Takeover via Email Change— hackadvisor
- [web][Pro]DocuNest— hackadvisor
- [web][Pro]Lab 118 — FlowDesk — Predictable Password Reset Token— hackadvisor