0

I was pentesting a web app and while doing a password change, the client checks for the old password but not the server. Also they've a CSRF vulnerability. So would it be possible to post directly to the server and change the password without the client?

  • Do you mean password change, not reset? Have you tried making such a request? – multithr3at3d May 15 at 23:26
  • Yes, password change, not reset. I've tried that. – Prady May 15 at 23:27
1

I was pentesting a web app and while doing a password reset, they check for the old password only in the client side but not in the server side.

They could be taking your current password at the client side and encrypting it or creating a random token from that password and other info and then sending it to the sever along with the new password for processing or Simply checking for the password at client side and then send some random number if the condition were true or false.Why?No reason but they could.

So would it be possible to post directly to the server and changing the password without going client side?

Yes,if and only if there is no current password or CSRF token in the request or a encrypted token that cannot be figured out by attacker then yes the web app in question is wide open to password change CSRF attack.You could easily make a POST/GET request and then lure the victim to an attacker site and change his password.

NOTE:-You might be missing a couple of check's.Keep poking.

What to do next?

Try and make the request for password change using burp repeater and take away all the cookies one by one and look at the bare minimum needed to make the request and you will know the answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.