Try to register with the email example@target.com. Sometimes these accounts have special privileges such as no rate limiting and bypass certain verifications.
Impersonation
Register twice using the same data but changing the sign-up component.
The victim’s account could be hijacked if the application allows resetting the password based on one of the sign-up components.
After sign up using victim email, try signup again but using different password
The attacker may impersonate the victim by using his data from another account.
The victim’s data can be removed entirely from the database or replaced with new ones entered by the attacker.
Username and other sensitive data such as document number, phone number, personal identification number, International Bank Account Number, etc., must be linked to the existing account and blocked from being used again.
Spoofing
Register twice using: the same email | + |. |uppercase|unicode.
The attacker could smuggle messages to the victim based on the registration form, which could help in a phishing campaign.
A victim’s mailbox can be flooded with vast amounts of email messages. Asa result, the mail server can place messages from the target domain in the spam or block them entirely from delivery.
An attacker could get registration bonuses multiple times.
Burp automatically encode the puny code -> Intercept the request and change the email field manually
"Email already exists" -> The app is vulnerable
Forgot password: Reset the password with the punycode email address. Again intercept the request and change the field in the request, use the puny code
You should get a SMTP callback with the reset password link - Reset the password
Login again with the original email and the new password
