Mostafa Ashraf
Description
As usual, try logging in with admin@bepractical.tech.
sign-up
first register new account and login nothing new
Go back and let’s check the reset password function. But this time, there is nothing vulnerable in the reset password function, so what should I do now?
I decided to check the signup page, so I went to my notes in Notion about this and found this tip
if the weebsite has no email verification
when sign up try to regeister using existing email by adding \n at the end
example
{"email":"mostafa.nada1221@gmail.com"}
|
{"email":"mostafa.nada1221@gmail.com\n"}
it could sign you into someone's account/overwrite his account
Register two accounts
But here, it worked for me with the same email. Let’s thread the steps:
- Created the first account with these credentials
email: mostafa123(as shown in the above photo). - Created another account with the same email but with a different password
email: 123456
When I went back to log in with the second account, it logged me into the first account with the password mostafa123.
So, Let’s go to signup page and register a new account with admin email admin@bepractical.tech:123456
Login as admin
Go back to the login, then enter these credentials. It will log you into the admin account.
Admin account …. Hacked gg