Original subtitles

okay welcome back

uh let me discuss the first bug from a

list

automatic leakage of password reset link

so i'm going to focus on forgot passport

functionality

and what is related to forgot password

functionality

is actually uh password reset links

right

when you have forgotten your password

then you can just use forgot password

functionality and then the so-called

password reset link

is sent to your email so this is how it

works

this is very common functionality in the

web applications

and this is how a password reset link

looks like of course the exemplary one

we've got

example.com reset.php

question mark token equal sign and the

value of this token right this is the

password reset

token it should be long and

unpredictable

so and this is how it works and i

believe that you know how it works from

your own experience

and now i'm going to show you very

interesting attack scenario

let's assume that you have forgotten the

password you requested password reset

link

and then you just decided to click this

link

or in other words the password reset

link is visited by you right

so you click the password reset link and

then

what's going to happen is the web page

is actually loaded

and you are asked to enter a new

password

this is how it works well the web page

is loaded but what you've got in the url

bar is the password reset link keep it

in mind

and now let me discuss an and

interesting scenario of

what can happen what bad can happen

and with your password is a link so here

is the story

when there is a resource from an

external domain that is loaded on the

web page

and again keep in mind that the password

reset link

is in the url bar then

the password reset link is sent in refer

header to the external domain

let me repeat this when the resource

from an external domain

is loaded on the web page the password

reset link is sent in refer header

to the external domain this is exactly

how

referrer header works so we've got our

web page

in the url bar we've got a password

reset link

if this web page needs to fetch a data

from an external domain like for example

an image then the browser sends out the

request

and in this request there is a refer

header

and the browser takes the url from the

url bar

puts this data so our password reset

link in the

into the referrer header and then the

request goes out to the external domain

external domain can take a look at this

request

and the external domain can ask a

question hmm

who wants to fetch the data from my

domain so

the external domain takes a look at the

referral header

and here is the answer here's the answer

who is asking about this data who wants

to fetch the data from the external

domain right

so this is how referral header works and

the the interesting part here is that

we definitely don't want our

password reset link with the password

reset token

to be disclosed automatically

via referral leakage to an external

domain

or to external domains right we don't

want it to happen

because when it happens then we are

actually talking about

disclosure of sensitive data very

sensitive piece of data gets

automatically disclosed to

external domains and yeah it happens

automatically because this is how

browsers work right they just

you know fetch the data from from other

domains

and this kind of problem uh can

happen so now i believe that uh

you understand how this attack works

you've got a

kind of you know understanding and you

see

the risk you see the impact the impact

is really high

because well it leads actually uh to

account takeover

right if the password is that link gets

disclosed

uh to external domain then everyone from

this external domain can

you know take this password reset link

and they can

change your password and and that's it

right so this is an account takeover

so now let's uh jump to the demo because

i want to show you

how you can find if this kind of problem

exists in a web application

or not so you are not only going to see

this attack in action but

you also learn how to check if the web

application is vulnerable

to this kind of problem and and yeah

let's let's jump straight to the demo