Hunt Forgot Password

Hunt Forgot Password is an authorized security-testing methodology for the password-reset flow, gated by a mandatory confirmation step requiring the user to state the exact target, confirm written authorization and scope, and approve the exact command before anything active runs - staying read-only and defensive-only otherwise.

It prioritizes username enumeration first because it is fast and gates the rest of the methodology: POST an invalid email to the forgot-password endpoint, then a known or likely-valid one, and compare the responses for a different message, status code, or body length. It then works through three more patterns - checking whether a reset token is returned directly in the API response instead of only being emailed (an immediate account-takeover vector if so), completing a full reset cycle and then replaying the same token to see if it's still accepted after use, and firing 10-20 rapid forgot-password requests at one email to see whether any rate limit, lockout, or CAPTCHA kicks in.

# Read-only first step; confirm scope before anything active.
cat scope.txt  # target list from the authorized engagement brief

Beyond those live tests, it names five vulnerability classes to check for: username enumeration via differing error messages or response timing; weak or predictable tokens (base64-encoded email-plus-timestamp, short numeric codes, sequential IDs); tokens not bound to session or IP, including a token leaking via the Referer header when the reset page loads a cross-origin resource with the token still in the URL, or via a <meta name=referrer> misconfiguration; reset links that don't expire within a reasonable window; and reset endpoints with no rate limit at all, which enables email-flooding DoS, token brute-force, and enumeration at scale.

Use it when you have explicit written authorization to assess a target's password-reset flow within a bug-bounty or penetration-test engagement, and the task matches these recovery-flow vulnerability classes.

Do not use it without confirmed written authorization and scope - the confirmation gate blocks any active probing until that is given. It is a docs-only methodology import and does not bundle upstream executable helper scripts, commands, or a testing engine; reinstall tooling from the source repo if needed.

Input is an authorized target's forgot-password and reset-password endpoints. Output is a set of concrete probe steps and the specific proof each requires: a measurably different response for username enumeration, a token visible in a response body for token exposure, a second successful use of an already-consumed token for replay, and an uncapped request count for missing rate limiting.

Chains with hunt-ato to assemble a full account-takeover from a confirmed recovery-flow primitive, hunt-cache-poison for host-header injection during reset-email generation, hunt-brute-force for the shared rate-limit testing pattern, hunt-auth-bypass for skipping the reset flow entirely, and hunt-mfa-bypass if MFA follows a reset. Findings are validated via triage-validation and reported via report-writing.

Authorized penetration testers and bug-bounty researchers who need a systematic way to test a password-reset flow for enumeration, weak or replayable tokens, missing binding, and missing rate limits, with a defined proof standard for each finding.