Vaultly - vaultly-002

Level: Easy Points: 10 Type: Daily Challenge

There exist a feature to reset your password. This feature gives a password reset link

The respective password reset request looks like

Key thing to look here is presence of email parameter in the request. Looking at the request first thing that comes in my mind is to replace this email parameter with target email. To test this, I created new account [e-mail] and replaced the earlier email parameter with [e-mail]. There was no protection at all, hence I was able to reset target's password.

After loggin in with target's creds we are shown the flag for this lab.