Broken Authentication - Password Reset Broken Logic скачать в хорошем качестве

Broken Authentication - Password Reset Broken Logic

In this authentication lab from Portswigger we see an example of broken logic in the password reset feature. Although the reset token is checked after the initial GET request (link in email), it is not checked in the subsequent POST request which actually sets the new password on the backend. It's therefore possible to reset the password for the victim user while bypassing the need for the password reset token. The important lesson for developers is that every http request needs its own security even if that request would typically be dispatched from a secure page. Attackers can craft arbitrary POST requests to any endpoint using proxy tools like burp suite. Support This Channel ====================== Please like and subscribe, it means a lot! Please buy me a coffee so I can continue to make content. https://buymeacoffee.com/zenshell My cybersec and webdev training site https://www.zenshell.ninja Join our Discord   / discord