Password reset poisoning: hijacking the link via Host header
If the reset link is built from the request Host header, an attacker points it at their own domain and receives the victim's token.
notes on hacking and technology
|
main menu
user menu
topics
|
latest postsTLS: downgrade and weak ciphersAn active attacker tries to make the connection negotiate the weakest available version or ciphers. POODLE, FREAK, Logjam lived there. Stack buffer overflow: the basics everything rests onWriting past a stack buffer overwrites the return address. Half the exploitation discipline grows from there. Format string: when %n writes to memoryprintf(user_input) is not harmless. Format specifiers read the stack and, with %n, write to a chosen address. Integer overflow: when numbers wrapAn integer past its maximum wraps to zero. A size check that overflows opens the way to a too-small buffer. Use-after-free: using freed memoryA pointer that outlives free points to reassignable memory. Filling it with controlled data turns a dangling pointer into control. GOT overwrite: hijacking library callsThe Global Offset Table holds the resolved addresses of library functions. Overwriting an entry hijacks every future call. ret2libc: reusing the library against NXWith a non-executable stack, you do not jump into shellcode: you jump into libc, straight to system("/bin/sh"). It is the ancestor of ROP. SROP: forging a sigreturnThe kernel restores all registers from a stack frame during sigreturn. Forging it gives full register control with a single gadget. Stack canary: how it is bypassedThe canary stops the linear overflow — unless you leak it, jump over it, or brute-force it a byte at a time. ASLR: the techniques to defeat itAddress randomization is beaten with a leak, with non-randomized bases, with low entropy, or with relative arithmetic. one_gadget and the glibc heap "houses"A single one_gadget call gives a shell. The "houses" are known techniques to corrupt the glibc heap toward that jump. |
latest posts
your IP address:
216.73.216.108
visitor #1
MOTD:
Every abstraction leaks somewhere. Here we look at where. |
topics