skills.rest
inventashif
inventashifCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-forgot-password

Detect authentication flaws in password reset and account recovery flows.

Updated Sep 6, 2026
Search Tags:#rate limiting#bug bounty#password reset#account takeover#authentication testing#token replay#username enumeration
One-click install
npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-forgot-password-inventashif
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-forgot-password
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/hunt-forgot-password
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-forgot-password-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Forgot-password and account recovery flows often contain broken-authentication flaws like username enumeration, leaked reset tokens, and token replay that lead to account takeover, and manually testing every pattern is slow and error-prone. ## Core Features & Use Cases - Five Detection Patterns: Tests username enumeration via response differences, reset tokens exposed in API responses, token replay after use, missing IP/session binding, and absent rate limiting on reset endpoints. - Token Weakness Analysis: Identifies predictable tokens derived from timestamps, sequential IDs, or short numeric codes, plus token leakage via Referer headers to third-party resources. - Use Case: During a bug bounty assessment, point the Skill at a target's forgot-password endpoint to systematically probe valid vs invalid email responses, attempt token reuse after a completed reset, and flood the endpoint to check for rate limiting. ## Quick Start Test the target application's forgot-password endpoint for username enumeration, token replay, exposed reset tokens, and missing rate limits.

Frequently Asked Questions about hunt-forgot-password

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test a forgot-password endpoint for username enumeration?▼

Submit the reset request with a clearly invalid email, then with a known-valid email, and compare the responses. Differences in message text, HTTP status code, body length, or response timing confirm username enumeration.

How to check if a password reset token can be reused?▼

Complete a full reset cycle by requesting a token and using it to change the password, then immediately submit the same token again. A second successful response means the token is not invalidated after use, enabling replay attacks.

What makes a password reset token predictable or weak?▼

Tokens derived from timestamps, usernames, or sequential IDs can be brute-forced or decoded. Short numeric codes of 4-6 digits are feasible to guess when the endpoint lacks rate limiting.

Can a reset token leak through the Referer header?▼

Yes, when the token appears in the reset page URL and that page loads cross-origin resources like analytics or CDN images, the full URL leaks to third parties via the Referer header. Check the reset page's outbound requests for token exposure.

When is a missing rate limit on password reset a vulnerability?▼

An uncapped reset endpoint enables email flooding against victims, brute-forcing of small token spaces, and username enumeration at scale. Confirm it by submitting 10-20 rapid requests without receiving a 429, lockout, or CAPTCHA.

Related Skills

Explore More Software Engineering Skills→
chainreactorschainreactors
235

katana

Crawl web targets to identify parameterized URLs, form targets, and JavaScript endpoints.

Official
Intermediate
marcboggsmarcboggs

hunt-ato

Tests nine account takeover paths including password reset flaws, OAuth misconfigurations, and MFA bypass chains.

Community
Intermediate
SkobynSkobyn

hunt-brute-force

Detect login brute force, OTP/2FA brute force, and credential stuffing vulnerabilities.

Community
Advanced
brabos-aibrabos-ai
8

add-health-check

Analyze project documentation, security, architecture, and data management practices.

Official
Advanced