Hunting for Bugs in Registration/Sign Up Feature -2021

Hey Guys!! How are you? I hope everyone is safe in Current Covid-19 Pandemic Situation. I am back with another Blog. Hope you will learn something new today.

So, Before learning to discover bugs. Lets understand the developer side of implementing Sign Up Features.

Implementing the Sign Up Feature:

We will take the example of a School Website( to learn the implementation of Sign Up Feature:
In this Example, The Students need to register to for accessing their Academic educational resource. Users of must have the ability to register as a member thus gaining access to the content of the site.

So, The Signup process can be implemented by school in two ways:

  1. Manual Signup — Registration based on user providing a series of specific user information. It usually includes form like name, email, password, confirm password, etc. as shown in image below.

2. Social Signup /OAuth— Registration via an integrated social media source via social media platform like Facebook, Twitter, or Google, the user can sign into a third party website instead of creating a new account specifically for that website.

In this Blog I will be talking about Bugs in Manual Sign up. Lets have Social Signup/ OAuth for our next blog topic.

Exploiting Signup Feature:

1. Duplicate registration / Overwrite existing user.

Duplicate registration is when an application allows us to register or sign up with the same email address, username or phone number. It can have critical consequences based on what kind of attack is performed.

Steps to reproduce:

1) Create first account in application with email say and password.
2) Logout of the account and create another account with same email and different password.
3) You can even try to change email case in some case like from to
4) Finish the creation process — and see that it succeeds
5) Now go back and try to login with email and the new password. You are successfully logged in.

Further Read

2. DOS at Name/Password field in Signup Page.

By sending a very long string (100000 characters) it’s possible to cause a denial a service attack on the server. This may lead to the website becoming unavailable or unresponsive. Usually this problem is caused by a vulnerable string hashing implementation. When a long string is sent, the string hashing process will result in CPU and memory exhaustion.

Steps to reproduce:

1) Go Sign up form.
2) Fill the form and enter a long string in password
3) Click on enter and you’ll get 500 Internal Server error if it is vulnerable.

Further Read

3. Cross-Site Scripting (XSS) in username, account name for registration.

Cross-site Scripting (XSS) is a security vulnerability usually found in websites and/or web applications that accept user input. This injects the malicious code into the targeted website’s content, making it a part of the website and thus allowing it to affect victims who may visit or view that website.

Now, for testing Signup page for XSS we can simply insert XSS payoad in fields like: username, email, password,etc.

Payload for Username field : <img src=x onerror=alert(1)>
Payload for Email field : “><svg/onload=confirm(1)>”@x.y

Further Read

4. No Rate Limit at Signup Page.

A rate limiting algorithm is used to check if the user session (or IP address) has to be limited based on the information in the session cache. Testing for Rate limit at Signup page is quite a good idea.

The Impact can be explained very well. If there is no rate limiting on signup page a malicious users can generate hundreds and thousands of fake accounts that lead to fill the application DataBase with fake accounts, Which can impact the business in many ways.

You can easily test for it with Burp Intruder.
1. Capture the signup request and send it to Intruder.
2. Add different emails as payload .
3. Fire up Intruder, And check whether it returns 200 OK.

Further Read

5. Insufficient Email Verification.

Insufficient Email Verification means the application doesn’t verify the email id or the verification mechanism is too weak to be bypassed. You can easily Bypass Email Verification with some of the following common methods like:

  1. Forced Browsing. (directly navigating to files which comes after verifying the email)
  2. Response or Status Code Manipulation. (Replacing the bad response status like 403 to 200 can be useful)
  3. There are much more ways of bypassing . Tip: Just google it.

Further Read

A Quick Mindmap:

Thanks for Reading. Any Suggestions are always welcomed!!

Support me if you like my work! Buy me a coffee and Follow me on Twitter.




Just a Cybersec Guy.

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

Cloud Pentesting for Noobs

The Internet of Things: Mitigating Risks to Harness the Upside

Cool Innovation 125/2022

Highlights of “Litentry & Friends” EP 2: DID in Instant Messaging

Photo Privacy

{UPDATE} Q12 Trivia Hack Free Resources Generator

Bringing you the solution to one of Blockchain’s biggest problem.

One Month Later — What was GDPR even about, and why we care

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store


Just a Cybersec Guy.

More from Medium

SQL injection Union attack: Determining the number of columns required in an SQL injection UNION…

Network Services

Understand Broken Authentication in 3 minutes

Insecure Deserialization — FAQ