# Password Reset Poisoning (CTF challenge)

> NimbusBank builds its password-reset links from a request header it shouldn't trust. Trigger a reset for the admin account, poison the host the reset link points to so the token lands on a server YOU…

Canonical: https://codelivly.com/ctf/challenges/password-reset-poisoning

| | |
|---|---|
| Category | Web Exploitation |
| Difficulty | Hard |
| Points | 1200 |
| Estimated time | 45 min |
| Type | Live instance |
| Solves | 13 |
| Author | Codelivly |

NimbusBank builds its password-reset links from a request header it shouldn't trust. Trigger a reset for the admin account, poison the host the reset link points to so the token lands on a server YOU control, then complete the reset and read the flag from the admin area. Your own isolated instance — the flag is unique to you. The admin's password is random, so guessing won't help; the reset flow is the way in.

## Related

- [All CTF challenges](https://codelivly.com/practice?type=ctf)