Hacksplaining Log in

Want everyone on your software team to learn this? Free 14-day trial.

Train my team

All an attacker has to do is request a password reset for a victim, and set the Host header to a domain they (the attacker) controls.

A Spoofed Host Header
HTTP 
POST /password/reset HTTP/1.1
Host: malicious.com
Content-Type: application/x-www-form-urlencoded

email=victim@gmail.com