Vulnerable Remember Password
Check List
Methodology
Black Box
Reauthentication For Changing Password Bypass
Go to accounts settings
Add an email address to the email which we have access to (Remember adding an email doesn't require you to re-enter password but changing password does)
Confirm the email address
Make it primary email (Even this doesn't require you to re-enter password)
Now we can change the password by reseting it through the new ema
Trigger the Passwordless / Remember Me Login
Register or log in normally
Tick "Remember me", "Stay logged in", or use "Sign in with this device"
Complete login → Note you are logged in
Open DevTools → Application → Local Storage / Session Storage / IndexedDB
Search for password, cred, token, user, email
If plain/encoded/base64 credentials found → Credential leak confirmed
then go to DevTools → Application → Cookies
Look for session cookie with no or very long Expires/Max-Age (1 year, "Session" but never expires)
Clickjacking on Auto-Login Page
Frame the login/auto-auth page
<iframe src="https://target.com/auto-login" style="opacity:0.1"></iframe>If auto-login triggers in iframe → Clickjacking possible
CSRF on Auto-Auth Flow
Craft CSRF PoC that visits the auto-login endpoint
<img src="https://target.com/remembered-login-endpoint">If victim visits → Automatically logged in as you → CSRF confirmed
White Box
Cheat Sheet
Last updated