๐Ÿงช
LAB
EXPERT

BOLA Multi-Step Password Reset Account Takeover (ATO)

UNSOLVED
๐Ÿ’ณ ApexPay Fintech Vault
Scenario 20

๐Ÿ”‘ ApexPay Corporate Gateway

Authenticate with your corporate credentials to access institutional liquidity reserves and treasury vaults.

โ„น๏ธ Pentester Briefing & Scope:
ApexPay employs a multi-tier identity architecture. You are provided with standard analyst employee credentials (carlos@apexpay.io / carlos123). Your objective as an ethical hacker is to investigate the multi-step password recovery workflow, perform API reconnaissance, and achieve Full Account Takeover (ATO) of the Executive Treasury Administrator.
Forgot password or need recovery? โ†’

Helpful Workstation Shortcuts

Use corporate reconnaissance resources to map personnel and inspect incoming security OTPs:

๐Ÿ‘ฅ Corporate Staff Directory ๐Ÿ“ฌ Employee Webmail (Carlos)