Account Takeover
CriticalAccount Takeover (ATO)
Definition
Account Takeover (ATO) is the full compromise of a user account, letting the attacker access and control it as if they were the legitimate owner. It can be achieved through multiple vectors: credential theft, XSS, CSRF to change the email/password, IDOR in password-reset features, or OAuth token manipulation.
Impact
Full control of the victim's accountAccess to personal, financial and private dataAbility to perform actions on the victim's behalfAccess to linked services (OAuth) from the compromised accountDirect financial loss if payment methods are attached
Examples
Account Takeover via a predictable password-reset token
If the password-reset token is predictable (based on timestamp, email, or sequential), the attacker can generate or guess it without access to the victim's email, letting them change the password and take control of the account.
# Request a password reset
POST /api/auth/forgot-password
{"email": "victim@example.com"}
# The server generates a token based on the timestamp
# Token = MD5(email + timestamp_seconds)
# The attacker can:
# 1. Record the exact timestamp of the request
# 2. Compute the token: MD5("victim@example.com" + "1713262800")
# 3. Use the token to reset the password
GET /reset-password?token=abc123computed&password=newpassword