What happens if an application uses predictable password reset tokens?

The correct answer is B. Account takeover. Predictable password reset tokens allow an attacker to guess or brute-force valid reset links, enabling them to reset another user's password and gain full control of that account - a classic account takeover (B). The attacker never needs the victim's credentials; they simply…

Question

Options

APrivilege escalation
BAccount takeover
CDirectory traversal
DXML External Entity injection

How the community answered

(27 responses)

A
4% (1)
B
81% (22)
C
11% (3)
D
4% (1)

Explanation

Predictable password reset tokens allow an attacker to guess or brute-force valid reset links, enabling them to reset another user's password and gain full control of that account - a classic account takeover (B). The attacker never needs the victim's credentials; they simply exploit the weak token generation to authenticate as the victim.

Why the distractors are wrong:

A (Privilege escalation) involves gaining higher permissions within an existing authenticated session - not applicable here since the attack targets authentication itself, not authorization levels.
C (Directory traversal) exploits insufficient path validation to access files outside the web root - completely unrelated to authentication tokens.
D (XML External Entity injection) abuses XML parsers to read files or make server-side requests - a parsing vulnerability, not an authentication one.

Memory tip: Think "predictable = guessable = someone else logs in as you." Any time a reset mechanism lacks randomness (using timestamps, sequential IDs, or user data as the token), it's an account takeover waiting to happen - associate weak tokens with OWASP A07 (Identification and Authentication Failures).

Community Discussion

No community discussion yet for this question.

Full GWAPT Practice