hunt-forgot-password
定位容易被忽视的账户恢复安全漏洞
可被滥用进行账户枚举或劫持，需合法授权
检测找回密码/重置流程中的枚举、令牌泄露与可重放缺陷
审查找回密码/账号恢复流程中常见的认证弱点：比如用户名枚举、重置 token 在 API 响应中暴露、token 用后未失效可重放、重置链接不绑定 IP/浏览器或没有速率限制。用于评估账号恢复被滥用的风险，从最容易发现的枚举问题开始快速定位并留取证据。特别侧重复现完整请求到响应的流程，证明具体的破坏手法。
▸ 展开 SKILL.md 英文原文
Hunt Forgot Password / Account Recovery Authentication Flaws — 5 distinct patterns: (1) username enumeration via different responses for valid vs invalid email, (2) reset token exposed directly in the API response body, (3) reset token not invalidated after use (replay), (4) password reset link works from a different IP/browser (no binding), (5) no rate limit on the reset request endpoint. These are the standalone recovery-flow broken-auth primitives — distinct from reset-email host-header poisoning (hunt-host-header) and the full ATO chain (hunt-ato owns password-reset as an ATO path; prove the primitive here, chain it there). Detection: trace the full forgot-password flow from request to token to use; check response diffs between valid/invalid emails; test token replay after consumption. Medium to High (enumeration=Medium, token-reuse=High, account-takeover=Critical when chained to known-email).
帮我安装这个 skill：https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-forgot-password/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-forgot-password/SKILL.md"## Autonomous Testing Priority
**Start with username enumeration — it's the fastest win and gates the rest.**
**Pattern 1 — Username enumeration (response difference for valid vs invalid email):**
1. POST to the forgot-password endpoint with a clearly invalid email (e.g. `nonexistent@fakedomain12345.com`) — record the response body, status code, and length
2. POST with an email you know exists (or try common patterns like `admin@target.com`, `test@target.com`, `user@target.com`)
3. Compare responses: different message ("Email sent" vs "Email not found"), different HTTP status, or meaningfully different body length = username enumeration confirmed
4. Proof: enumeration is confirmed when the