Lab 6 - Exploiting time-sensitive vulnerabilities

In this challenge we are not going to exploit race condition but broken forget password logic to reset the password of the user carlos then login as carlos and delete the user carlos.

Date: 4 September 2026

Table of Content

1. Initial Recon
2. Exploitation
3. Conclusion

Initial Recon

When we visit the login page we are presented with this :

Forgot Password ask us for username or email let’s normally enter our username wiener and intercept the request in burp.

It send the password reset link to our registered mail id.

https://0a5200e304317ef7808ad0db007a00cf.web-security-academy.net/forgot-password?user=wiener&token=f16df8d148aea36e4c88ce58273ce4909dd30d62

This is the link we got to reset the password having a field token

Let’s try to send the password request link two times using groups in repeater.

But make sure both the request have different session token and csrf token

To get this we can send the forgot password request third time to repeater and then change the method to get and endpoint to /forgot-password removing the cookie :

Now sending both the request in parallel

Visiting the email client :

We can see we recieved two password reset link with same token because the response time for both request were :

Exploitation

After the initial recon phase exploitation part is pretty straight forward.

We will again send two request one for wiener and one for carlos both the request will be sent in parallel so getting same timestamp so the token will be.

Copy the link and change username to carlos :

We can reset the password now.

As carlos we can complete the task.

YAA!! Solved the challenge

Conclusion

The challenge was successfully solved by exploiting a broken password-reset logic where reset tokens were generated based on the request timestamp. By sending password-reset requests for wiener and carlos simultaneously, we obtained the same token and used it to reset carlos’s password. We then logged in as carlos and deleted the account.