inurl:/forgotpassword intext:"enter username and email"

  • 日期:2020-03-26
  • 类别:
  • 作者:Rafin Rahman Chowdhury
  • 语法:inurl:/forgotpassword intext:"enter username and email"
  • # Google Dork: inurl:/forgotpassword intext:"enter username and email"

    # The search results found from this dork, are potentially vulnerable sites
    to account takeover. If attacker inserts victim's username along with
    attacker's email address, than attacker might receive password reset link
    or code for the target user on his(attacker) own mail. Or, if attacker
    attempts password reset for his own account, then intercept and modifies
    the http request body with victim credentials(i.e. username, email), than
    he might successfully reach victim's password reset page. Using these two
    methods, attacker might be able to takeover any user account.

    # Date: 25/03/2020

    # Author: Rafin Rahman Chowdhury