hunt-forgot-password

## Autonomous Testing Priority **Start with username enumeration — it's the fastest win and gates the rest.** **Pattern 1 — Username enumeration (response difference for valid vs invalid email):** 1. POST to the forgot-password endpoint with a clearly invalid email (e.g. `nonexistent@fakedomain12345.com`) — record the response body, status code, and length 2. POST with an email you know exists (or try common patterns like `admin@target.com`, `test@target.com`, `user@target.com`) 3. Compare responses: different message ("Email sent" vs "Email not found"), different HTTP status, or meaningfully different body length = username enumeration confirmed 4. Proof: enumeration is confirmed when the two responses differ measurably (baseline vs probe) in message text, status code, or body length **Pattern 2 — Reset token exposed in the API response:** Some APIs return the reset token directly in the response body (instead of only emailing it). POST to the forgot-password endpoint and look for a token, link, or code in the JSON/HTML response. If a token appears that lets you reset the password, that's an immediate account-takeover vector. **Pattern 3 — Reset token replay (reuse after use):** 1. Complete a full password reset cycle: request token → use it to reset password 2. Immediately try submitting the same token again to the reset-password endpoint 3. If the second submission returns 200 or "success" → token not invalidated after use **Pattern 4 — No rate limit on reset requests...