> For the complete documentation index, see [llms.txt](https://notes.dollarboysushil.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.dollarboysushil.com/web-application-pentest/bugforge/broken-access-control/vaultly-vaultly-002.md).
# Vaultly - vaultly-002
Level: Easy\
Points: 10\
Type: Daily Challenge
There exist a feature to reset your password. This feature gives a password reset link
The respective password reset request looks like
Key thing to look here is presence of `email` parameter in the request. Looking at the request first thing that comes in my mind is to replace this email parameter with target email.\
\
To test this, I created new account `target@gmail.com` and replaced the earlier email parameter with `target@gmail.com`. \
There was no protection at all, hence I was able to reset target's password.
After loggin in with target's creds we are shown the flag for this lab.