Webgoat - Admin lost password

Webgoat – Admin lost password

In this walk through, we will be going through the Admin lost password vulnerability section from Webgoat Labs. We will be exploring and exploiting Login panels with Admin lost password and learn how application are affected because of it. So, let’s get started with the Hacking without any delay.

Admin lost password

  • In this challenge, we have to find the admin’s lost password and sign it with it to get the flag.

Webgoat admin login panel

  • I intercepted the request via Burpsuite and analzyed the response.

Burpsuite intercept

Burpsuite response

  • After banging my head here and there, the only asset on the page which seems something different as it has no extension was our logo image.

Page source code

Webgoat logo

  • I enabled all the filter for The MIME type in our Burpsuite HTTP history and filter our logo file.

Configure filter

Matching responses

  • Searching through the response for the string “Admin” reveals us the password.

Burpsuite intercept

Got the password

  • Logged in with the found password and got the flag. Submit it to complete the challenge.

admin: !!webgoat_admin_1179!!

Challenge completed

Flag submitted!

Also Read: Webgoat – Bypass front-end restrictions



So, we finally completed the Webgoat Admin lost password Vulnerability section. Next, we can mitigate these types of attacks by processing data more on the server side and not give the user the access to interfere with the application’s logic by manipulating data on client side. On that note, i will take your leave and will meet you in next one with another Webgoat vulnerability writeup, till then “Keep Hacking”.

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top