4 ms·
Judging my the response letter it seems they think he only managed to reset a password... not setting the password. Will be interesting to read the follow up.
by z3t4 6y ago
Judging my the response letter it seems they think he only managed to reset a password... not setting the password. Will be interesting to read the follow up.
- hh3k0 6y ago> Judging my the response letter it seems they think he only managed to reset a password That wouldn't really make sense, would it? As it allowed him to log in. > So let’s get back to see what I’ve done here, I sent random requests using intruder with a CSRF token and random emails with a new password to this endpoint /savepassword > Now I went to the login page and I put the login email and the new password and BOOM I logged in Successfully into the application and I can enter the admin panel