Beginner·150 points·19 solves
Lumen — Weak Password-Reset Token
Learn why password-reset tokens must be random and unguessable: if a token is a predictable function of known data (like the email address), an attacker can compute anyone's reset token and take over their account.
Lumen builds the reset token as md5(email)[:12] — a fixed function of the email address with no secret and no randomness. Because you receive the reset email for your OWN account, you can see your own token; and because the token depends only on the address, you can compute it for any account, including the administrator's. The token is never disclosed for other people's accounts — the flaw is that it's computable, not that it's leaked. A secure reset token is long, cryptographically random, single-use, and time-limited, stored server-side and tied to the account — never derived from the email.
Your tasks
1
Request a reset for yourself
Open the lab and request a password reset for your own account, guest@lumen.io. You receive the email, so you can see your reset link and its token.
2
Study your token
Your token is a 12-character hex string. It has no randomness between requests — it is a fixed function of your address. Which common hash of your email produces exactly these 12 hex characters?
3
Work out the scheme
Confirm the token equals the first 12 hex of md5(your email). Now you can compute it for ANY address.
4
Reset the administrator
Compute md5(admin@lumen.io)[:12] and use it as the token in the reset-confirm link for admin@lumen.io.
5
Capture the flag
Confirming the administrator's reset reveals the master account key — the flag.
Submit the flag
Start the lab, capture the flag from the running machine, and submit it here.