> For the complete documentation index, see [llms.txt](https://kruknight.gitbook.io/daemon-of-hacking/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kruknight.gitbook.io/daemon-of-hacking/writeups/portswigger-labs/authentication/password-reset-broken-logic.md).
# Password reset broken logic
## Lab description
## Walkthrough
### Step 1: Understand the Password Reset Functionality
Begin by navigating to the login page and selecting the "Forgot password?" link. The application will prompt you to enter a username. Start by testing the reset process with your own account, using the username `wiener`.
When going to the forget password page we find that it asks for a username so we type our account username `wiener` and click submit
### Step 2: Inspect the Email Reset Link
After submitting your username, an email is sent to your associated email account. This email contains a reset link, which directs you to a page prompting you to enter a new password twice.
### Step 3: Analyze the Reset Password Request
Submit a new password, and intercept the request using Burp Suite. Carefully inspect the request payload. You will notice:
* A `temp-forgot-password-token` is included in both the header and the body of the request.
* A `username` parameter specifies which account’s password is being reset.
### Step 4: Exploit Logic Flaw
After analyzing the request, remove the `temp-forgot-password-token` from both the header and the body. Resubmit the request. Observe that the server processes the request without validating the token. This indicates that the token isn’t required to reset the password.
### Step 5: Reset Carlos’s Password:
First, request a password reset for Carlos by entering his username on the "Forgot password?" page.
* Intercept the reset request for your own account (Wiener) and modify the `username` field to `carlos`. Update the `new-password-1` and `new-password-2` fields to the desired new password for Carlos (e.g., `KruKnight`).
* Send the modified request.
### **Step 6: Verify Access to Carlos’s Account**
Navigate to the login page, enter `carlos` as the username and the newly set password. You should successfully log in to Carlos’s account, confirming the exploit worked.
