@declanmidd: 😳 I Found a Password Reset Flaw in a CTF… In this clip from my previous livestream, I was testing an authorized VulNyx CTF using Burp Suite when I noticed something unusual. Normally, when you request a password reset, the recovery code should remain secret and only be delivered securely to the account owner. Instead, the web server returned the generated recovery code directly in its HTTP response. If this happened in a real-world application, it could expose sensitive password reset information and weaken the security of the account recovery process. This type of issue is commonly known as an information disclosure vulnerability because the application reveals data that should never be exposed to the client. ⚠️ Disclaimer: This demonstration was performed in an authorized CTF/lab environment for cybersecurity education only. Never test systems without explicit permission. #C#CyberSecurityE#EthicalHackingB#BurpSuiteW#WebSecurityI#InfoSec#CTF

Declan Middleton

Open In TikTok:

Region: NZ

Saturday 04 July 2026 03:13:13 GMT