A "forgot password" flow builds the emailed reset link from the incoming request. Make the link point at infrastructure you control so the victim's token lands in your lap.
Reset your password
Enter the account email and we'll send a reset link. In this sandbox no mail is delivered —
we show you the exact link the server would have emailed.
The link's host is taken from the request, so the intended host is pinned by the page —
change it with an intercepting proxy.
Stuck? You've missed the flag a few times. The full solution — root cause, exact payload and fix — is on the walkthrough page.
