Lab: Bypassing access controls using email address parsing discrepancies
This lab validates email addresses to prevent attackers from registering addresses from unauthorized domains. There is a parser discrepancy in the validation logic and library used to parse email addresses.
To solve the lab, exploit this flaw to register an account and delete carlos.
Required knowledge
To solve this lab, you'll need to understand the techniques described in the Splitting the Email Atom: Exploiting Parsers to Bypass Access Controls whitepaper by Gareth Heyes of the PortSwigger Research team.
Register for free to track your learning progress
-
Practise exploiting vulnerabilities on realistic targets.
-
Record your progression from Apprentice to Expert.
-
See where you rank in our Hall of Fame.
Already got an account? Login here
