Loading video…
All breakouts
Burp Suiteseen in 2 videos →
4.1Talking HeadOther hook
Hook
Intercept on
@declanmidd
40.0K followers · usually 2.5K views a post
Views
10.0K
Likes
448
Comments
4
Shares
18
Selling · SaaS › Developer Tool
Product placement
Burp Suite: ACTS - It is used to intercept and manipulate web requests, which is demonstrated in the video. Removing it would change the demonstration of the vulnerability. VulNyx CTF: APPEARS - It is the name of a Capture The Flag challenge that is being tested. Removing it would not change what happens in the video, but it would remove context about the specific challenge. UniPanel: ACTS - It is the name of the web application being tested. Removing it would change the context of the demonstration, as the vulnerability is within this application. Password Manager: ACTS - It is mentioned as the place where passwords are saved. Removing it would not change the core demonstration, but it would remove a detail about password management.
On-screen text
Intercept onnForwardnDropnRequestnResponsenPrettynRawnHexnHTTP/1.1 200 OKnDate: Fri, 03 Jul 2026 08:25:47 GMTnServer: Apache/2.4.58 (Ubuntu)nExpires: Thu, 19 Nov 1981 08:52:00 GMTnCache-Control: no-store, no-cache, must-revalidatenPragma: no-cachenContent-Length: 163nKeep-Alive: timeout=5, max=100nConnection: Keep-AlivenContent-Type: application/jsonn{n "status": "success",n "message": "If the user exists, an email has been sent with a new password.",n "update": {n "user": "admin",n "generated_recovery_password": "769jbr8w"n }n}nUniPanelnRecover AccessnA new password will be sent to the user's registered email.nusernamenadminnIf the user exists, an email has been sent with a new password.nCancelnSendnUniPanelnInvalid username or password.nUSERNAMEnadminnPASSWORDnSign InnForgot password?nConfirm Form ResubmissionnThe page that you're looking for used information that you entered. Returning to that page might cause any action you took to be repeated. Do you want to continue?nCancelnContinuenUniPanelnNot securenuniversity.nyx/administration/dashboard.phpnOverviewnStudentsnFacultynNewsnSave password?nUsernamenadminnPasswordnNevernNo thanksnSavenPasswords are saved to Password Manager on this device.nDashboard OverviewnTotal Studentsn40nFaculty Membersn20nSystem StatusnActivenStudents AdministrationnStudents ManagementnFull NamenMajornJamesnAndersonnSoftwarenEngineeringnEmily WatsonnArchitecturenMichaelnBrownnComputernSciencenSarahnJenkinsnMechanicalnEngineeringnDavid MillernCivil EngineeringnJessicanTaylornMathematicsnRobertnWilsonnPhysicsnJasonnSimsonnChemistrynFaculty DirectorynFaculty RecordsnProfessornNamenDepartmentnDr. AlannTuringnSTEMnProf. AdanLovelacenSTEMnDr. RichardnFeynmannSTEMnDr. MarienCurienMedicinenProf. JohnnMaynardnKeynesnBusinessnDr. GracenHopbernSTEMnProf. FranknLloydnWrightnArtsnNoamnSmetskynHumanitiesnSocial SciencesnSign Out
Original caption
😳 I Found a Password Reset Flaw in a CTF… In this clip from my previous livestream, I was testing an authorized VulNyx CTF using Burp Suite when I noticed something unusual. Normally, when you request a password reset, the recovery code should remain secret and only be delivered securely to the account owner. Instead, the web server returned the generated recovery code directly in its HTTP response. If this happened in a real-world application, it could expose sensitive password reset information and weaken the security of the account recovery process. This type of issue is commonly known as an information disclosure vulnerability because the application reveals data that should never be exposed to the client. ⚠️ Disclaimer: This demonstration was performed in an authorized CTF/lab environment for cybersecurity education only. Never test systems without explicit permission. #C#CyberSecurityE#EthicalHackingB#BurpSuiteW#WebSecurityI#InfoSec#CTF
More from @declanmidd
Their other posts in the index, biggest breakout first.
