This video shows the lab solution of "Basic password reset poisoning" from Web Security Academy (Portswigger)
Link to the lab: https://portswigger.net/web-security/host-header/exploiting/password-reset-poisoning/lab-host-header-basic-password-reset-poisoning