this website offers a functionality to reset your password in case you forgot it just like any other website on the internet you put your username to which you want to reset the password and then click reset and the reset link will be sent to your email you can then click on this link to set a new password but this website is vulnerable a hacker can reset the password of any user on this website let me show you how before moving on a quick word about the sponsors of this video this video is sponsored by appmysite.com
with app my site you can easily convert your website into a native mobile application for both Android and iOS and the best thing is that you don't even have to write a single line of code to do this and it only takes 10 to 15 minutes to create your own app you can build your own app by just submitting your website URL choose your app's appearance like icon themes background etc etc choose what content from your website you want to display on your app and that's it their AI powered app builder will build an app
for you based on your choices for both Android and iOS you can then preview your app on a simulator or on your own real device and see how it turned out app my site also comes with a woocommerce integration plugin which makes converting your online store built with woocommerce into a native mobile application a smooth and quick process you can even integrate your app with Firebase to add more functionality to your app integrate chat system to chat with your app's users push notifications to your users and even monetize your app with Google admob all from
within your app my site dashboard so go ahead and check out app my site the link will be in the description below before we exploit this let's try the thing from the perspective of the developer who coded this password reset functionality when user requests a password reset a random reset token is generated and then it is appended to a URL and this URL is sent to the user via email when the user clicks on this password reset URL the website checks the reset token and if it is valid it redirects the user to a page
where you can set a new password now the vulnerability exists in the construction of this password reset URL the URL goes like this HTTP or https and then the hostname or the domain name of the website followed by the randomly generated reset token look more closely at the host value in the URL a good programming practice is to store the host value in an environment variable and use it in scenarios like this but what if the host value is taken from the request header let me explain every HTTP request has some headers one of which
is called the host header and as the name suggests it contains the host value which can either be the domain name of the website or its IP address if the website doesn't have a domain name if the backend code of the website takes the host value from the host header which we control then we can potentially even control the password reset URL that is being constructed so I can simply change the host header to my own server IP address what this does is that it directs the password reset URL to my web server that I
host so when the user clicks on the link the password reset request that contains the reset token is now sent to my web server I can now simply forward this reset token to the actual website to change the password of the user let's exploit this vulnerability on this website now this website is actually a part of the hack the Box machine called forgot so if you want to try this for yourself find the link in the description below first I will spawn up a HTTP server using python the server is listening on my IP address
at Port 8000. now I'll go to the website click on forgot password and enter the username of the user whose password I want to change but before sending this request I will intercept it with burp suit in the request I will change the host header value to my IP address colon 8000. remember this is where my HTTP server is listening on my machine I send this request and now I'll simply wait for the user to click on the password reset URL but what if the user never clicks on the link well that is a possibility
but there is some comfort in use for the attacker when a new email is received email clients automatically scan the URLs from the email in order to detect malicious links and prevent users from clicking on them so even if the user never clicks on the link manually his email client may do so I'm not saying all the email clients do this I am just saying that there is a possibility and when that happens or the user clicks on the link himself we have the reset token of the user I will now simply copy this get
request paste it in my browser and add the host of the actual website and when I send this request I am taken to a page where I can actually change change the password and that's it just like that we are able to change the password of a user on this website by exploiting the host header injection vulnerability so that will be all for this video thanks for watching if you like this video please do not forget to leave a thumbs up below if you're not yet a subscriber please do hit that subscribe button and also
turn on the Bell icon to receive instant updates about my channel I'll see you in the next video Until Then cheers
