CVE-2021-45901

This exploit performs username enumeration in ServiceNow by leveraging a vulnerability in the password reset functionality. It brute-forces a list of usernames and checks for valid users based on HTTP response codes.

This repository contains a Python script for enumerating valid usernames in ServiceNow by exploiting a discrepancy in HTTP responses during password reset requests. The PoC automates the process by leveraging session tokens, CSRF tokens, and X-UserToken extracted from client-side code.