Testing Password Reset Flows for Token Reuse and Host Poisoning

Summary

This tutorial shows a practical workflow for testing password reset implementations, including token lifecycle controls and host header behavior.

Checklist

1. Request multiple reset tokens and verify single-use guarantees.
2. Test token expiry with boundary timestamps.
3. Tamper with Host and forwarding headers to detect poisoned reset links.
4. Confirm account lockout and telemetry behavior for repeated reset attempts.

Example Probe

curl -i https://target.example/reset/request \
  -H "Host: evil.test" \
  -d "email=user@example.com"

If generated links include attacker-controlled hosts, escalate as high severity.