Tweet

Steiner254

Nov 11 • 20 tweets • 5 min read

Day 0⃣2⃣/2⃣0⃣ -- [Registration/SignUp Page Vulnerabilities]
➡️ Day 2, we will cover potential vulnerabilities that can affect a Registration/Sign-Up Page of a web application
➡️ Below are Tips & References (Feel Free To Share)🧵🧵👇👇
#BugBounty
#bugbountytips
#cybersecuritytips

1/n
Registration Page Vulnerabilities
github.com/carlospolop/ha…

2/n
Registration & Takeover Vulnerabilities
book.hacktricks.xyz/pentesting-web…

3/n
weak registration page

4/n
No password length/ Long Password Sign-up - DDOS Ability
hackerone.com/reports/840598

5/n
Open Redirect in registration page

6/n
Sql Injection On Login And SignUp Function

7/n
OTP Bypass on Register account
kathan19.gitbook.io/howtohunt/auth…

8/n
OTP bypass and Account takeover using response manipulation
infosecwriteups.com/otp-bypass-and…

9/n
OTP BYPASS THROUGH RESPONSE MANIPULATION
agnihackers.medium.com/otp-bypass-thr…

10/n
No rate limiting while creating accounts

11/n
Email verification link does not expire after use

12/n
Email Verification Bypass

13/n
Duplicate registration
book.hacktricks.xyz/pentesting-web…

14/n
Weak password policy

15/n
Stored HTML Injection

16/n
SQL Injection on registration form 302 redirect
stackoverflow.com/questions/5582…

@_zwink

17/n
Hunting Authentication Bypass in Bug Bounty by @_zwink

@Steiner254

18/n
Sign Up Page IDOR by @Steiner254

https://twitter.com/Steiner254/status/1545655039582248962

n/n
Practice Makes Perfect!
Happy Hacking :)
See you here same time tomorrow!

• • •

Missing some Tweet in this thread? You can try to force a refresh

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @steiner254

Steiner254

@steiner254

Nov 12

Day 0⃣3⃣/2⃣0⃣ -- [How To Hack A Login Page!]
➡️ Day 3, How To Hack A Login Page "Exploiting Vulnerabilities On A Login Page"
➡️ Below are Tips & References (Feel Free To Share)🧵🧵👇👇
#BugBounty
#bugbountytips
#cybersecuritytips

1/n
10 Common vulnerabilities found in the login functionality
redhuntlabs.com/blog/10-most-c…

2/n
Portswigger vulnerabilities on password based login
portswigger.net/web-security/a…

Read 20 tweets

Steiner254

@steiner254

Nov 10

Day 0⃣1⃣/2⃣0⃣ -- [Bug Bounty Reconnaissance/Information Gathering]

➡️ Being Day 1, Recon is usually the first approach when handling your target.
➡️ Below are some of the Best Checklists/Bug Bounty RECON references & Tips🧵🧵👇👇
#BugBounty
#bugbountytips
#cybersecuritytips

@Jhaddix

1/n
The Bug Hunter's Methodology v4.0 - Recon Edition by @Jhaddix

@_zwink

2/n
@_zwink Target Reconnaissance & Approach

Read 23 tweets

Steiner254

@steiner254

May 2

Bug Bounty Pro Tips
If You Have Any, Please Feel Free To Add To The Thread
#bugbountytips
#bugbountytip
#cybersecuritytips
Pro Tip — Android applications can suffer from LFI and stored XSS just by injecting <iframe/src=/etc/hosts> into input fields.

Tip for finding SSRF

To demonstrate XSS impact, don’t use alert(‘alert’). Determine whether session is stored in cookies or local storage and put that in the popup. cookie: alert(document.cookie) LocalStorage: alert(localStorage.getItem(‘access_token’))

Read 50 tweets

Steiner254

@steiner254

Apr 30

Different Hacking/Bug Bounty Methodologies From Different Hackers/Bug Bounty Hunters.
Feel Free To Add In This Thread If You Have Any :)
#BugBounty
#bugbountytips
#CyberSecurity
infosecwriteups.com/bug-hunting-me…