password-reset-poisoning

Host header poisoning manipulates HTTP Host headers to trick a web application into sending password reset tokens to an attacker-controlled domain, enabling account takeover.

You intercept password reset tokens by exploiting Referer header leakage or email injection vulnerabilities, capturing the tokens as they are transmitted to external resources or attacker-controlled addresses.

Analyze reset token entropy by examining the character space and length of generated tokens to identify weak or predictable patterns, making them viable targets for brute-force attacks.

Yes, exploiting insecure account recovery flows requires tools like Burp Suite and curl to intercept requests, manipulate headers, and analyze token entropy during penetration testing.

The best way to bypass password resets is to poison host headers, intercept tokens via referer or email injection, and brute-force weak tokens to exploit insecure recovery flows.