OWASP / OWASP/SecurityShepherd
Potential Bug in Session Management Challenge 5
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.5k
- Forks
- 515
- Avg merge
- 3h 46m
- Merged PRs (30d)
- 1
Description
Hello
I have problem with “Session Management Challenge 5”. I have checked with other Students who have solved this challenge and the told me, that it worked for them this way
- Passwort Reset request «admin»
- The subUserName, newPassword and resetPasswordToken (“TimaeStamp” in base64) send to the ChangePass URL with OWASP ZAP
- Receive the following request:
a.Password change request success.
- Try to login as admin,
a. Receive: incorrect password for admin
I’ve made a video doing these steps
Here is the link to the video:
https://youtu.be/dUB1tuF_VP8
Before I posted the Issue here, I spoke to my teacher about this Issue an she told me, I should post this Issue here.
Greetings
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing Session Management Challenge 5 using the reported password-reset and ChangePass request sequence in OWASP ZAP. Inspect the ChangePass handling and the subsequent admin login behavior, using the linked video for context. Done means determining why the reported successful password change does not permit admin login and resolving or clearly documenting the behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100