Reset your password
Enter the account email and we'll send a reset link. In this sandbox no mail is delivered — we show you the exact link the server would have emailed.
The link's host is taken from the request, so the intended host is pinned by the page — change it with an intercepting proxy.
Stuck? You've missed the flag a few times. The full solution — root cause, exact payload and fix — is on the walkthrough page.
Check the solution on the walkthrough page →This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of CSPSHIVAM Playground is not part of the target.