Lab: Password reset poisoning via dangling markup
Summary: This PortSwigger lab demonstrates password reset poisoning via dangling markup, in which tampering with the domain name in the Host header causes a server error, but adding an arbitrary non-numeric port to the Host header still reaches the site normally and triggers a password reset email. The port is then used to break out of the string and inject a dangling-markup payload pointing to the exploit server, with the goal of logging in to Carlos's account.
What you should know: The reset email is generated from a Host header the attacker controls, so a link your system sends to a user can be redirected to an attacker's server without any flaw in the reset token itself.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026