> For the complete documentation index, see [llms.txt](https://notes.dollarboysushil.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.dollarboysushil.com/web-application-pentest/bugforge/business-logic-flaw/cheesy-does-it-forgot_password-flaw.md).
# Cheesy Does It (forgot\_password flaw)
Level: Easy\
Points: 10\
Type: Daily Challenge
During register/login we can see forgot password feature.
Forgot-password takes only one arguement i.e `username` , we can pass any username here.
Once username is passed, OTP is sent to account's email address. The ui doesnot takes the value more than 4 digit.\
Meaning we can try to bruteforce the OTP.
There is no any rate limiting system and we can successfully bruteforce the OTP.\
After successfull OTP bruteforce, we get the reset\_token
From the js file,we can get idea on how to use the reset\_token to change the password.
POST request to /api/verify-token with values of
* `username`
* `reset_token`
* `new_password`
Password successfully changed.
Now, we can login as admin and get the flag.