-2

While testing a website i noticed a weird behaviour. When resetting the password a POST request with empty body is generated. The request is the following:

POST /reset/token/[token]/passwhord-hash

Now my question is: If google or any third party will intercept this request, will it also be able to log the password-hash and reset token?

8
  • If it is intercepted, then yes. But how are you expecting it to be intercepted? It's sent over TLS, right?
    – schroeder
    Jan 14 '20 at 16:34
  • For example if you leave facebook opened while you reset the password or if google sniff your traffic and it get saved into google search engine. Yes over TLS. Would it be worse if the password is sent as plain/text?
    – Pong
    Jan 14 '20 at 16:36
  • "facebook opened while you reset the password" huh? "google sniff your traffic" - how? And if over TLS, then all they would see is encrypted text. How on earth would it be indexed on a search engine?
    – schroeder
    Jan 14 '20 at 16:38
  • 1
    And you think they know by inspecting traffic? They look at what you do openly and in public.
    – schroeder
    Jan 14 '20 at 16:47
  • 2
    I think you have a few wrong assumptions here and you have combined them together. Empty POST request: stackoverflow.com/questions/4191593/… And the "interception" part is not based on an understanding of how "google or any thrird party" works.
    – schroeder
    Jan 14 '20 at 16:49
1

Now my question is: If google or any third party will intercept this request, will it also be able to log the password-hash and reset token?

Sure,if google or third party sits between you and the network and somehow is able to break ssl/tls then they get all the clear text transmission,you are toast at that point,Not sure how the particular request has anything to do with it.

How does facebook and google knows everything about you? That's because they always try to look at what you are doing online

Probably not how that works.Although facebook was caught once trying to get people to install root CA by paying 20$,lol

Not the answer you're looking for? Browse other questions tagged or ask your own question.