Technique
technique:password_reset_attack
Abuse of account-recovery workflows to obtain access to Gmail and then a WordPress administration account.
Abuse of account-recovery workflows to obtain access to Gmail and then a WordPress administration account.
“we’d just do a password reset request on their Gmail account”
“the WordPress site would e-mail them a link to make a new password”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | USES | TeaMp0isoN | Explicit | 109 |
TeaMp0isoN USES password reset attack
The attackers requested Gmail password resets and persuaded employees to disclose the received security codes.
Explicit Confidence 99% · Jack Rhysider EP 109 Details
“we’d just do a password reset request on their Gmail account”