OWASP Security Shepherd Project - Session Management Challenge 5 (Session Management Challenge)

Challenge

Solution

    First, login with admin / admin to see what will happens? -> Incorrect password for admin.
We know the admin account do exists, but we don't know the password.

     Let's try to click the Forgotten Password? button.

Input admin as User Name -> URL with embedded password reset token has been sent to 'admin' via email.

      We don't have the email of admin user. Let's see the packet in BurpSuite.
Request packet:

Response packet:

    Nothing special...

    Let's check the source code scripts:

//Change Password Form (Requires Valid Token)
//Token life is 10 mins
$("#leForm3").submit(function(){
var theUserName = $("#subUserName").val();
var theNewPassword = $("#subNewPass").val();
var theToken = $("#updatePasswordToken").val();
$("#resetSubmit").hide("fast");
$("#resetLoadingSign").show("slow");
$("#resultsDiv2").hide("slow", function(){
var ajaxCall = $.ajax({
type: "POST",
url: "7aed58f3a00087d56c844ed9474c671f8999680556c127a19ee79fa5d7a132e1ChangePass",
data: {
userName: theUserName,
newPassword: theNewPassword,
resetPasswordToken: theToken
},
async: false
});
......

    Here is a hidden form for reset password!
We got the URL of the post request for reset password & we know the token must related to time.

    Frankly to say, I don't know what to do next, so I check the cheat session and notice that the token is base64 encoding of server date.

    Now, we could get GMT time from the response of POST request of send Email!

Fri, 12 Jul 2019 05:27:32 GMT is the server time, we could convert it to linux date default format  -> date -d 'Fri, 12 Jul 2019 05:38:55 GMT' '+%a %b %e %T %Z %Y'

p.s. Please set timezone you want before using the date command. (Ex: export TZ='Asia/Taipei')

Then, we run base64 encoding -> echo 'Fri Jul 12 13:38:55 CST 2019' | base64

      Finally, we could use the URL & Token to try reset the password of admin.

    Then, just use the new account / password for login -> Done : )