Registration Form

https://xmind.ai/share/6ZrhpTgT

Impersonation

Register twice using the same data but changing the sign-up component.

• The victim’s account could be hijacked if the application allows resetting the password based on one of the sign-up components.

Duplicate Registration - The Twinning TwinsMedium

POST /newaccount HTTP/1.1
...
email=[e-mail]&password=1234

After sign up using victim email, try signup again but using different password

POST /newaccount HTTP/1.1
...
email=[e-mail]&password=hacked

• The attacker may impersonate the victim by using his data from another account.

• The victim’s data can be removed entirely from the database or replaced with new ones entered by the attacker.

Username and other sensitive data such as document number, phone number, personal identification number, International Bank Account Number, etc., must be linked to the existing account and blocked from being used again.

Spoofing

Register twice using: the same email | + |. |uppercase|unicode.

• The attacker could smuggle messages to the victim based on the registration form, which could help in a phishing campaign.

• A victim’s mailbox can be flooded with vast amounts of email messages. Asa result, the mail server can place messages from the target domain in the spam or block them entirely from delivery.

• An attacker could get registration bonuses multiple times.

SSTI

In name field:

"{{7*7}}<img>
"">{{7*7}}<img>"

XSS

{{constructor.constructor('alert(`XSS`)')()}}

An unusual way to find XSS injection in one minuteMedium

Fake Informations

OpSec / Anonymity

Akto Developer Security Free Tools

Username

Username Generator | Random Username Generator - Akto Free Tool

Phone

Phone number Generator | Phone Number Creator - Akto Free Tool

Receive SMS

Receive SMS online for free

Address

Address Generator | Random Address Generator - Akto Tools