What problem does it solve?
During authorized penetration tests, password reset, registration, and profile-modification endpoints often contain logic flaws such as verification code leakage, brute-forceable codes, and missing authorization checks. This Skill provides a structured methodology to systematically identify and validate these weaknesses.
Core Features & Use Cases
- Reset Flow Analysis: Maps the forgot-password chain step by step, capturing requests and responses to locate where codes are generated, returned, and validated.
- Verification Code Testing: Detects code echo in responses, brute-forceable short codes without rate limits, validation bypass via parameter removal or replay, and unrestricted SMS sending endpoints.
- Arbitrary User Modification & Privileged Registration: Tests replacing target phone numbers or user IDs in reset requests, and abusing unauthenticated interfaces such as registersysuser, goedituser, or login_tologin.do to modify other users' passwords or register admin accounts.
- Use Case: While assessing a ThinkPHP-based shopping site, use this methodology to test the login, registration, and password recovery SMS code logic separately, confirming whether a code issued to account A can reset account B.
Quick Start
Analyze the target application's forgot-password flow using this methodology and check whether the verification code can be leaked, brute-forced, or reused to reset another user's password.
