Hackbot finds admin password reset vuln with human nudge

JS0N Haddix@Jhaddix

### HackBot Stories #1 ###

Topic: Human in the Loop

In our first implementations of running our hackbot against customers, we had a customer where we rigged up our hackbot to drive an actual browser to get better coverage on dynamic JavaScript loading via lazy loading and things like that.

Since we had the option to watch the browser live, we had it up on another monitor, and I was watching it work . The AI model driving the browser passed by several pages in succession, and one of them, I noticed, was the user forgot password page.

That was all fine and expected for one of these applications that it found. A short time later, I sought to visit a second forgot password page that had completely different styling and lacked an email input for the forgot password.

The bot quickly moved on to other pages.

I had to jump back into the TUI and prompt it, saying, "Hey, it's unusual for an application to have two forgot password pages for users. Are you sure that wasn't a hidden admin reset password functionality that we stumbled onto?"

Of course, the model said I was a genius.

I then revisited the page for the admin reset password function and was really out of ideas at first. Driving the chat, I said, "Hey, normally we'd have an input somewhere in the source or somewhere else to reset a specific ID of a user, either via account ID or email, but we don't have that here. What other ways could we try to discover how this form takes the POST request that sets a password?" And this was me assuming that the API call behind all this did not require authentication. After this little bit of nudging, the AI decided to brute-force parameters on this page and eventually came up with the parameter "ID" and added the value "1". This reset the first ID in the database's password to password. And also conveniently auto-logged us into the application, where we had complete control of an admin GUI for the site.

Without human review of the output of the agent or having seen it live, we might have completely missed this bug. Without reprompting to discuss deeper methods, we would have missed how to exploit it.

The learnings for this were that, in our pipeline, a human has to review all of the endpoints that our custom JavaScript parsing skill and spider find. LLMs are not always the best at understanding the context of the website and what might be considered a vulnerability. And then the second learning was to add parameter brute forcing as a step for any exploitation modules that are at a standstill in the same type of scenario.