Reset and magic-link binding
A reset or magic link is a bearer token delivered through mail. The questions are who receives it, whether it is bound to a browser or session, and whether it can be used twice.
Tags: email, session, ato
Level: intermediate
Method
Use mailboxes you own
Request reset for an account you control. Do not send mail to anyone else.
Tools: browser
See where the link points
Host, path, and whether the token is in the query, the fragment, or a path segment. A token in a URL will leak via Referer if the next page loads a third party.
Tools: Burp Suite
Binding
Open the link in a different browser than the one that requested it. If that is intended, say so. If the product claims the link is bound to the original browser and it is not, that is the note.
Tools: browser
Reuse
Use the link once, then again. A second success means it was not single-use.
Tools: Burp Suite
Who the address maps to
If signup, the mailer, and SSO disagree on the mailbox, map the difference with addresses you own. Identity confusion is the bug, not a cosmetic alias.
Tools: browser
Host of the link
The host-header playbook covers poisoned hosts. Here, record whether the link host is the application host. Do not repeat that playbook as if it were new.
Tools: Burp Suite
Field notes
- A reset that only works for your own inbox is not account takeover.
- Fragment tokens are not sent to the server on the first navigation. Say where the app reads them.
- Expiration belongs in the report. A ten-minute single-use link is a different bug from a week-long reusable one.