The Ravens’ forgot-password page sends a reset token, but the token is not random — it is derived from the username by a simple rule. Request a reset for your own account guest to see your token, work out the rule, then apply it to the leader, admin.
The Ravens password reset has two parts: request a reset token for a user, then reset with it. Your own token is shown to you, and from it you discover the token is computed from the username by a fixed, non-random rule. Your target is the admin account.
Compute the leader’s reset token and reset his password to take over his account.
You computed the leader’s reset token and reset his password, taking over the account.
Why the solution worked
The reset token was predictable, derived from the username by a fixed rule, so anyone who knows the rule computes any account’s token and takes it over. A reset token must be long and random from a secure generator, tied to the account, short-lived, single-use, and delivered only through a channel the account owner controls — never revealed to whoever requests the reset.
The root cause
The reset token is derived from the username by a fixed, reversible function instead of a random value with a short expiry, so an attacker can compute any user token.
How the code is fixed
A reset token is a temporary, random, single-use secret sent only to the account owner. Any derivation from known data breaks it.
Vulnerable code
function resetToken(username) {
// Predictable: reverse + length. Anyone can compute it for any user.
return [...username].reverse().join('') + username.length;
}
Safe code
async function startReset(user) {
const token = crypto.randomBytes(32).toString('hex'); // random, unguessable
await db.saveReset(user.id, await hash(token), Date.now() + 15 * 60_000); // hashed, 15 min, single use
await email(user.email, resetLink(token)); // only to the owner's address
}
Impact in the real world
Predictable reset tokens enable takeover of any account without knowing its password, among the most dangerous flaws in account-recovery flows.
How defenders detect it
Defenders generate random, short-lived, single-use reset tokens and alert on reset attempts against many accounts from one source.
