hunt-forgot-password

Autonomous Testing Priority

Start with username enumeration — it's the fastest win and gates the rest.

Pattern 1 — Username enumeration (response difference for valid vs invalid email):

1. POST to the forgot-password endpoint with a clearly invalid email (e.g. nonexistent@fakedomain12345.com) — record the response body, status code, and length
2. POST with an email you know exists (or try common patterns like admin@target.com, test@target.com, user@target.com)
3. Compare responses: different message ("Email sent" vs "Email not found"), different HTTP status, or meaningfully different body length = username enumeration confirmed
4. Proof: enumeration is confirmed when the two responses differ measurably (baseline vs probe) in message text, status code, or body length

Pattern 2 — Reset token exposed in the API response: Some APIs return the reset token directly in the response body (instead of only emailing it). POST to the forgot-password endpoint and look for a token, link, or code in the JSON/HTML response. If a token appears that lets you reset the password, that's an immediate account-takeover vector.

Pattern 3 — Reset token replay (reuse after use):

1. Complete a full password reset cycle: request token → use it to reset password
2. Immediately try submitting the same token again to the reset-password endpoint
3. If the second submission returns 200 or "success" → token not invalidated after use