# 0 Click ATO with the Sandwich Attack

Password reset tokens were UUIDv1, so sandwiching a victim's reset between two own resets narrowed the timestamp and enabled brute-forcing to full account takeover.

- Payout: $5,000
- Severity: high
- Program: -
- Credited: Roni Carta
- Disclosed: 2023-08-11
- Write-up quality: 7/10
- Original: https://www.landh.tech/blog/20230811-sandwich-attack/
- Library page: https://bugbountylibrary.com/r/blog%3Alandh-tech-blog-20230811-sandwich-attack
- Tags: domain:web impact:ato kind:bounty platform:blog sev:high tech:rest technique:fuzzing technique:recon vuln:account-takeover vuln:auth-bypass

**Target:** Password reset endpoint
**Root cause:** Password reset tokens were UUIDv1, which embed a predictable timestamp, clock sequence, and MAC address, making them brute-forceable within a narrow window.
**Steps:**
1. Trigger password reset for own account, capture UUIDv1 token (first bread).
2. Trigger password reset for victim email (filling).
3. Trigger another reset for own account, capture second UUIDv1 token (second bread).
4. Decode High/Mid/Low timestamp fields of both tokens to bound the victim token's generation time.
5. Enumerate 30 resets to identify distinct Node ID/Clock Sequence values (6 machines observed), multiplying candidate space.
6. Generate all UUIDs in the time window with the sandwich Ruby tool.
7. Fuzz the reset-password endpoint with ffuf using the candidate token list until the victim's token validates.
8. Use the valid token to set a new password and take over the account.
**How found:** Noticed the reset link token was a UUIDv1 rather than random UUIDv4; recognized that V1 embeds timestamp/MAC/clock sequence, making it predictable and brute-forceable within a sandwiched window.
**Exploitation:** Attacker sandwiches a victim reset between two of their own resets, derives the timestamp range from the UUIDv1 fields, generates ~100k candidate tokens (times 6 machines), and brute-forces the reset endpoint to obtain a valid token, achieving zero-interaction account takeover.
**Insight:** When a reset token looks like a UUID, check its version nibble: V1 leaks timestamp and MAC, so sandwich two of your own resets around the victim's to bound the search space, and sample many resets to enumerate distinct generator machines.