hunt-forgot-password

1## Autonomous Testing Priority
2 
3**Start with username enumeration — it's the fastest win and gates the rest.**
4 
5**Pattern 1 — Username enumeration (response difference for valid vs invalid email):**
61. POST to the forgot-password endpoint with a clearly invalid email (e.g. `nonexistent@fakedomain12345.com`) — record the response body, status code, and length
72. POST with an email you know exists (or try common patterns like `admin@target.com`, `test@target.com`, `user@target.com`)
83. Compare responses: different message ("Email sent" vs "Email not found"), different HTTP status, or meaningfully different body length = username enumeration confirmed
94. Proof: enumeration is confirmed when the two responses differ measurably (baseline vs probe) in message text, status code, or body length
10 
11**Pattern 2 — Reset token exposed in the API response:**
12Some APIs return the reset token directly in the response body (instead of only emailing it). POST to the forgot-password endpoint and look for a token, link, or code in the JSON/HTML response. If a token appears that lets you reset the password, that's an immediate account-takeover vector.
13 
14**Pattern 3 — Reset token replay (reuse after use):**
151. Complete a full password reset cycle: request token → use it to reset password
162. Immediately try submitting the same token again to the reset-password endpoint
173. If the second submission returns 200 or "success" → token not invalidated after use
18…