Mostafa Ashraf

Description

In this lab, they want me to take over the admin account but didn’t provide any credentials for logging in

Sign up

there is a singup button ,I am using a temporary email address mohmal.com

Let’s register an account
.

Login

After creating an account, let’s go back to the login page to enter the account that we created.

Okay, nice. What should I do now? I tried response manipulation like in the first lab, but it didn’t work here.

Reset Password

So,let’s test the reset password function

I entered the temporary email address to receive the OTP on it and then clicked send (BurpSuite fired in the background). The OTP has been sent, so I checked my email to get it

So, I entered the code and intercepted the request with BurpSuite.

change the emailforOtp parameter to admin@bepractical.tech and forward the request

now go to firefox

Admin account …. Hacked gg