How I Was Able to Block Any Username

FREE ARTICLE

Hello Everyone!

Today, I’ll share how I discovered a flaw that allowed me to block or lock any username on a platform.

I was hunting on a program called redacted.com, where the scope was limited to the main website (redacted.com). I began testing different areas:

Business logic flawsSession management issuesKnown CVEs

While exploring, I decided to test the account deletion feature. My goal was to see if deleting an account required a password confirmation.

I attempted to delete my account.Unfortunately, a password confirmation was required, so I provided it and successfully deleted my account.

After deletion, I tried to recreate my account with the same username (jeetpal2007).

To my surprise:

The username was unavailable for reuse.It seemed permanently locked in the system.

So, I created a new account with the username jeetpal, which was still available.

I noticed a peculiar behavior:

When an account was deleted, only the email and password were removed from the database.