password-reset-methodology

Password reset / unauthorized registration and modification methodology

Applicable scenarios

Use when password recovery, verification codes, or user registration/profile modification interfaces are involved.

忘记密码流程
├── 步骤：手机号/邮箱 → 验证码 → 重置密码
├── 每个步骤的请求/响应都要抓包分析
└── 重点：验证码如何校验、如何返回、是否可重放

Verification code echo: The response packet/interface return directly contains the verification code (SMS/image/email verification code echo)
Verification code brute-forceable: The verification code length is too short (4 digits) and there is no rate limiting
Verification code validation bypass: Delete/blank out the code parameter, modify the response, concurrent replay, universal verification code
SMS bombing/sending interface not rate-limited: The verification code sending interface has no limit on the number of times

Reset interface replaces the target phone number/user ID:mobile=<目标>&code=<自己的验证码>
Registration/profile modification interface privilege escalation:registersysuser、goedituser : and other interfaces have no authentication or do not verify data ownership
Validation method: use A's verification code to reset B's account; call admin-type registration interfaces with low privileges/while unauthenticated
Example:login_tologin.do : When login/registration entry points have authentication bypass, an admin can be registered without authorization

Common issues with SMS verification codes in mall-type systems (thinkphp framework): the verification code is stored in Session so it can be concurrent, the interface can be replayed, the response packet leaks the code
Test the verification code logic at the three places: login/registration/password recovery separately