My first Account-take-over

“I explored the website’s functions until I found the one responsible for ‘edit-emil.’

At this point, I realized there was a high likelihood of finding a Account-take-over vulnerability. I needed to confirm two critical things:

Referrer: I had to make sure the website allowed email changes from different sources. In other words, I needed to check if I could change the email with a referrer that’s different from the original website.
For example:
Referrer: https://www.target.com/edit-emil
I confirmed I could change it to anything, such as:
Referrer: https://www.attacker.com/edit-emil

I succeeded! :)

We were now 50% closer to confirming the vulnerability.

Token: This was the hardest part since most websites thoroughly verify it. However, there are various ways to bypass token validation if the site checks it. Now it was time for exploitation.

response:
200 ok

“I quickly created the HTML page, wrote the code, and confirmed the vulnerability.”