Loading...
The signup flow is the front door where user input first hits the database and authentication layer — making it a goldmine for bugs. From logic flaws to critical account takeovers.
Registration system vulnerability testing including mass assignment, duplicate accounts, and OTP bypass.
Last updated: 2026-05-15
The signup flow is the 'front door' where user input first hits the database and authentication layer — making it a goldmine for bugs: logic flaws, critical vulnerabilities, and account takeovers.Create account A (victim@gmail.com) → Log out → Re-register same email with different password → Login with new passwordIf abc@gmail.com exists → Register Abc@gmail.com or aBc@gmail.compython -c "print('A'*20000)" → Paste into password field → SubmitMonitor response time. If request hangs and returns 500 Internal Server Error, server struggled to process the input.Fill signup → Intercept in Burp → Send to Intruder → Mark email as payload position → Set Numbers 1-1000 → StartMass account registration can flood the database, send spam, and enable ban evasion."><img src=x onerror=alert(1)><svg/onload=confirm(1)>"><svg/onload=confirm(1)>"@x.yTry case variation (<ScRiPt>), different event handlers (onmouseover, onsubmit), or encoded payloadsIntercept JSON response after signup → Look for "is_verified": false, "status": "pending" → Change to true/success → ForwardIntercept 403/302 response → Change status to 200 OK → Remove Location headerRegister without verifying → Try force-browsing: /user/dashboard, /account/settings, /onboarding/step2Sign up with attacker@mail.com → Receive verification link (DON'T open) → Change email to victim@mail.com → Open original link for attacker@mail.comToken is tied to user ID, not email address — stale token verifies the new email.Try registering with disposable email: @mailinator.com, @tempmail.com, @10minutemail.comReplace https:// with http:// on the signup page URLTry: 123456, password, qwerty, adminTry password = usernameTry password = email addressCheck security questions set during signup — are they easily guessable?If profiles are at target.com/{username} → Register: login, admin, signup, api, dashboardRegister: index.php, login.php, signup.php, admin.aspxNavigate to target.com/login.php → If your profile loads instead of the login page, route collision succeeds.Intercept signup request → Modify: empty username/email, short password, invalid email (test@test, a@b), special charsBypassed validation can lead to: malformed accounts, stored XSS, broken workflows, injection vulnerabilities.Intercept signup → email=victim@gmail.com&email=attacker@gmail.comCan lead to: Account takeover, bypassed validation, corrupted user records.Register → Inspect verification link → Look for: Base64 email, short tokens, incrementing IDsIf tokens are guessable, attackers can verify accounts they don't own.admin@example.com vs аdmin@example.com (Cyrillic 'а') — they look identical but are different stringsIf app normalizes both to same value, use Unicode version to takeover legitimate account.Start signup → Intercept OTP verification → Send rapid sequential guesses → Try changing IPsAttacker can verify any email/phone without owning it — breaks the trust model entirely.Start signup → Capture session cookie → Complete verification → Compare session ID before/afterTry registering multiple accounts without refreshing token → Reuse same token across accounts/devicesRegister: attacker@mail.com%00victim@mail.com or username%00.jpgIf backend truncates at null byte, you can override account attributes or bypass checks.Register with random email → Skip confirmation → Try logging in directly → Try profile update or password resetAttackers can register with any email and impersonate other users.Start signup → Save session ID → Complete signup + verification → Compare session ID before/afterAttackers can force victims into attacker-controlled sessions and takeover newly created accounts.Complete signup/verification → Use browser back button → Inspect cached pages for OTP, tokens, verification statusSignup/verification pages must set: Cache-Control: no-store, no-cache, Pragma: no-cacheCreate accounts A and B → While both in onboarding, capture API calls → Replace IDs/emails from A with BOnboarding endpoints often lack strict access control — test early in the flow.Intercept JSON signup request → Add unexpected fields: role, is_admin, is_verified, organization_idChange parameter casing or shape (role vs Role, user[role]) to bypass server filtersFull guide: infosecwriteups.com/mass-assignment-registration-flowsA signup flow carries many hidden risks: duplicate accounts, missing rate limits, weak passwords, broken verification. Tightening registration early makes the entire app more secure.