# Lumen — Weak Password-Reset Token (lab)

> Lumen emails a password-reset link when you forget your password, but the reset token is derived in a completely predictable way.

Canonical: https://codelivly.com/labs/weak-password-reset

| | |
|---|---|
| Type | Web |
| Difficulty | Beginner |
| Points | 150 |
| Session length | 30 min |
| Completions | 19 |

Lumen emails a password-reset link when you forget your password, but the reset token is derived in a completely predictable way. You know your own address (guest@lumen.io); the administrator is admin@lumen.io. Work out how the token is built, then reset the administrator's account and read the flag.

## Objective

Learn why password-reset tokens must be random and unguessable: if a token is a predictable function of known data (like the email address), an attacker can compute anyone's reset token and take over their account.

## Tasks

1. Request a reset for yourself
2. Study your token
3. Work out the scheme
4. Reset the administrator
5. Capture the flag

## Related

- [All labs](https://codelivly.com/practice?type=lab)