<aside> 🧾

Checklist for BB tasks.

</aside>

Authentication & Registration page

• [ ] Check for SSTI in registration form
• [ ] Check Username field for stored XSS
• [ ] If OTP or MFA is used, try to tampering the status False→ True etc
• [ ] Try leaked credentials or common credentials. Example, [email protected] | common passwords
• [ ] In Forgot password, if a parameter is used when you reset using a link, try tampering the parameters False→ True etc for Account take over

File upload page

• [ ] Try to rename the file on the go using burp
• [ ] Try double extentions
• [ ] Try to use null bytes
• [ ] Try to add magic numbers
• [ ] Try XSS payloads in filename
• [ ] Try XXE payloads in file content if svg/xml are accepted
• [ ] Try RCE payloads in file content
• [ ] If php is blocked, bypass using php3,php2,php5 etc
• [ ] Try changing the acceptable content type with disallowed file type.

Finding XSS

• [ ] Look for feature where user input is reflected, like search feature. You can test for HTMLi, RXSS