Bugs in User Registration

Email OTP Verification Bypass via Response Manipulation

Steps to Reproduce:

  1. Navigate to Signup Page

  2. Enter your email: asad76725@gmail.com

  3. Click Get OTP under Email Verification

  4. Enter a random OTP (e.g., 111111)

  5. Intercept the OTP verification request using Burp Suite

  6. Observe the original server response:

  7. Modify the response to: Other valid OTP response

  8. Forward the modified response

  9. Email verification succeeds without a valid OTP

-------------------------------------------------------------------------------------------

Duplicate Registration / Overwriting Existing Users

Steps to Reproduce:

  1. Initial Setup: Create a legitimate first account (e.g., email: victim@gmail.comenvelope, password: Password123). Log out.

  2. Re-register: Create a new account using the exact same email (victim@gmail.comenvelope) but a different password (e.g., AttackerPass999).

  3. Verification: Try to log in using victim@gmail.comenvelope and the new password (AttackerPass999). If the application allows the process to finish successfully without throwing an “Email already exists” error, you have takeover the original account.

Variation: Case Sensitivity Bypass

Sometimes developers check for duplicates using exact string matching but store data in a case-insensitive collation database.

-------------------------------------------------------------------------------------------

Denial of Service (DoS) at Input Fields

Steps to Reproduce:

  1. Go to the Sign-up form.

  2. Fill in normal data for most fields.

  3. In the Password field (or sometimes the Username field), enter an extremely long string of characters (e.g., 10,000+ ‘A’s). You can generate this easily in a text editor or using Python: python -c “print(‘A’*20000)”. and Submit the form.

Monitor the response time. If the request hangs for a long time and eventually returns a 500 Internal Server Error, it indicates the server struggled to process the input, suggesting a vulnerability.

-------------------------------------------------------------------------------------------

Lack of Rate Limiting (Mass Assignment)

Steps to Reproduce:

  1. Fill out the signup form with generic details and submit it, intercepting the request in a proxy tool like Burp Suite.

  2. Send the captured POST request to Burp Intruder.

  3. In the Intruder “Positions” tab, clear existing payload markers. Add markers (§§) around the email parameter value. Example: email=testuser§1§@examplearrow-up-right.com

  4. In the “Payloads” tab, choose “Numbers” (e.g., from 1 to 1000) or provide a list of different email addresses and Start the attack.

Analyze the results. If you receive a 200 OK (or whatever the success response code is for hundreds of consecutive requests without being blocked or presented with a CAPTCHA, the endpoint lacks rate limiting.

-------------------------------------------------------------------------------------------

Weak Registration Implementation

This category covers general security best practices that are often ignored during the signup process.

  • Allows Disposable Email Addresses: The application should block domains from known temporary email providers (e.g., Mailinator, TempMail). Allowing these invites abuse, spam, and ban evasion.

  • Registration Form on non-HTTPS: If the signup page is served over HTTP, all data entered including the new password and personal information is transmitted in plaintext and can be intercepted by a Man-in-the-Middle attacker. you can also test by replacing https:// with http:// manually.

-------------------------------------------------------------------------------------------

Testing for Weak Password Policy

A signup form must enforce a strong password policy to protect users from brute-force or credential-stuffing attacks later on.

How to Test:

  • Determine how strong the password policy is by evaluating the length, complexity, reuse, and aging requirements of passwords.

  • Observe that it’’ possible to set common passwords, such as password or 123456.

Vulnerabilities:

  • Weak Password Policy.

Check for the following weaknesses:

  1. Easily Guessable Passwords: Does the form accept passwords like 123456, password, qwerty, or admin?

  2. Username as Password: Does the form allow the password to be identical to the username? This is a very common pattern for lazy users.

  3. Email as Password: Does it allow the password to be the same as the email address?

  4. Improper Password Recovery: While technically part of the login flow, the foundation is laid at registration. Ensure the mechanism for future password resets (e.g., security questions set during signup) is secure and not easily guessable.

Remediation:

  • Introduce additional authentication controls (i.e. two-factor authentication) or introduce a strong password policy.

-------------------------------------------------------------------------------------------

Path Overwrite (Route Collision)

If an application hosts user profiles on the root path (e.g., site.com/{username}), an attacker can potentially “take over” critical system pages by registering a username that matches a system endpoint or filename.

Steps to Reproduce:

  1. Identify URL Pattern: Confirm that user profiles are accessible directly via target.tld/username.

  2. Register Reserved Names: Attempt to signup with usernames corresponding to critical pages or files.

  • Modern Apps: login, admin, signup, api, dashboard.

  • Legacy Apps: index.php, login.php, signup.php, admin.aspx.

3. Verify Overwrite: Navigate to the target URL (e.g., target.tld/login.php).

If your user profile loads instead of the actual login form or system page, you have successfully executed a Route Collision.

-------------------------------------------------------------------------------------------

Server-Side Validation Bypass (Client-Side Only Checks)

A lot of applications rely heavily on client-side validation to enforce rules like password length, allowed characters, field formats, and required inputs. The problem is that anything enforced only in the browser can be bypassed easily with a proxy or a modified request. If the backend isn’t validating properly, attackers can push malformed or dangerous data into the system.

Steps to Reproduce:

  1. Open the signup page and fill in the fields with any data.

  2. Intercept the outgoing request using Burp Suite, OWASP ZAP, or a browser extension like Tamper.

  3. Modify parameters that would normally be blocked by frontend rules.

Examples:

  • Empty username or email

  • Password shorter than the minimum requirement

  • Invalid email format (e.g., test@test, a@b, abc)

  • Special characters in fields that normally block them

4. Forward the request to the server.

If the registration still succeeds despite breaking the frontend rules, the server lacks proper validation. This can lead to malformed accounts, stored XSS, broken workflows, or even injection vulnerabilities.

-------------------------------------------------------------------------------------------

Hidden / Unlinked Registration Endpoints

Some applications expose multiple signup endpoints due to older versions, admin flows, mobile APIs or legacy functionality. These endpoints sometimes skip validations, email verification or business logic checks.

Steps to Reproduce:

  1. Spider or crawl the application.

  2. Look for endpoints like:

3. Compare the validation rules between each endpoint.

If any alternate endpoint allows registration without proper checks (like no email verification, no rate limiting, no password rules), it becomes an easy target for abuse.

-------------------------------------------------------------------------------------------

Parameter Pollution in Signup Requests

HTTP Parameter Pollution (HPP) becomes dangerous when the backend doesn’t clearly define how duplicate parameters are handled. Attackers can inject extra parameters to override existing values or sneak values past validation.

Steps to Reproduce:

  1. Intercept the signup request.

  2. Add multiple values to the same parameter. Example:

3. Forward the request.

If the server picks the wrong value or inconsistently processes it, you may trigger: Account takeover, Bypassed validation, Confusing or corrupted user records..

-------------------------------------------------------------------------------------------

Weak or Predictable Verification Links

Verification links are often predictable or too short, which makes brute forcing possible.

Steps to Reproduce:

  1. Register a legitimate account and inspect the verification link format.

  2. Look for patterns like:

  • Base64 email

  • Short token values

  • Incrementing IDs

3. Attempt token manipulation.

If tokens are guessable or not tied to the account securely, attackers can verify accounts they don’t own or hijack the verification flow.

-------------------------------------------------------------------------------------------

Punycode and IDN Homograph Bypass

Internationalized domain names allow characters from different languages. The problem is that many Unicode characters look identical to normal English letters, even though they’re completely different under the hood. This opens the door for signup and password-reset bypasses when apps normalize emails incorrectly.

Quick example:

admin@example.comenvelope and аdmin@example.comenvelope (Cyrillic “a”) They look the same but represent two different strings. In Punycode format, it becomes something like: xn — dmin-7cd@example.comenvelope.

If the app treats both as the same after normalization, you can use the Unicode version during signup or password-reset and take over the legitimate account. For the full walkthrough with screenshots and PoC steps, you can check out the detailed article on this method.

-------------------------------------------------------------------------------------------

OTP Verification Brute-Force During Signup

Steps to Reproduce:

  1. Begin a signup flow that sends an OTP.

  2. Intercept the OTP verification request.

  3. Test whether you can:

  • Send OTP attempts without limits

  • Use rapid sequential guesses

  • Change IPs and continue guessing

4. Look for HTTP headers or messages indicating lockout.

If OTPs can be brute-forced, an attacker can complete signup for any email or number without owning it. This breaks the trust model of verification entirely.

-------------------------------------------------------------------------------------------

Weak or Reusable Session Tokens During Signup

Many systems issue an initial session token during registration and continue using it through verification, onboarding, and first login. If the token is not regenerated, attackers can preload a session and force victims into it.

Steps to Reproduce:

  1. Start a signup flow and capture the session cookie.

  2. Complete verification and onboarding.

  3. Compare the session token before and after verification.

  4. Try registering multiple accounts without refreshing your token.

  5. Attempt to reuse the same token across different accounts or devices.

If the session stays the same, it’s vulnerable to session fixation or hijacking. The signup process becomes a takeover vector.

-------------------------------------------------------------------------------------------

Null Byte Injection (%00) in Signup Inputs

Some backend systems still improperly handle null bytes in strings, causing truncation or unsafe transformations. If validation happens before the null byte but storage happens after, attackers can bypass rules or corrupt user data.

Steps to Reproduce:

  1. Register using values like: attacker@mail.comenvelope%00victim@mail.comenvelope or username%00.jpg

  2. Observe how the backend stores or displays the data.

  3. Attempt login or verification afterward.

If the backend truncates at the null byte, you can override or break account attributes and occasionally bypass checks entirely.

-------------------------------------------------------------------------------------------

Missing Email Confirmation Enforcement

Some applications allow users to sign up and log in without confirming ownership of their email. This flaw lets attackers register accounts with any email and impersonate other users.

Steps to Reproduce:

  1. Register using a random email.

  2. Skip the confirmation link.

  3. Try logging in directly.

  4. Attempt actions like profile update or password reset.

If the app treats the account as fully active without verifying the email, it is vulnerable.

-------------------------------------------------------------------------------------------

Session Fixation During Signup & Verification

If the server does not rotate the session ID during signup, attackers can force victims into attacker-controlled sessions and take over their freshly created accounts.

Steps to Reproduce:

  1. Start a signup flow and save the session ID.

  2. Complete signup and verification.

  3. Compare the session ID before and after the process.

  4. Try accessing the account using the original ID.

If the ID stays the same, the platform is vulnerable to session fixation.

-------------------------------------------------------------------------------------------

Cache Control Issues in Signup & Verification Flows

Certain pages in the signup or verification process may be cached accidentally, revealing sensitive data when using shared devices or browsers.

Steps to Reproduce:

  1. Complete signup or verification.

  2. Use the back button or offline mode.

  3. Inspect cached pages.

  4. Test private browsing and shared device scenarios.

If OTP screens, tokens, or verification status pages appear from cache, the application mishandles caching.

-------------------------------------------------------------------------------------------

Cross-Account IDOR Test After Signup

During signup, onboarding endpoints often lack strict access control. Testing with two fresh accounts exposes IDOR issues.

Steps to Reproduce:

  1. Create two accounts: A and B.

  2. While both are in early signup or onboarding stages, capture API calls.

  3. Replace IDs or emails from A with B.

  4. Try updating or viewing each other’s onboarding steps.

If one account can modify or view another’s data, the signup flow is vulnerable to IDOR attacks.

-------------------------------------------------------------------------------------------

Finding Mass-Assignment Bugs in JSON-Based Registration Flows

APIs that accept JSON during registration are particularly prone to mass-assignment and parameter tampering issues. Attackers can add unexpected fields or alter parameter shapes and casing to influence server-side logic (for example, granting themselves elevated roles, joining organizations, or bypassing verification). I’ve covered all the JSON-based signup manipulation techniques in the next article, so you can dive deeper there.

Last updated