P4 Bugs and PoC | Part 2

Hi everyone! 👋

I’m Abhijeet Kumawat — a passionate bug bounty hunter and security researcher. I love sharing my knowledge and experiences in bug bounty hunting and penetration testing. 🚀

Today, I’m thrilled to continue my P4 bug series, where I dive into low-severity vulnerabilities that often go unnoticed but can have significant consequences when exploited properly.

In this post, we’ll explore two commonly overlooked yet critical vulnerabilities: Weak Registration Implementation and Weak Password Reset Implementation. I’ll explain how these bugs work, show you how to reproduce them step-by-step, and provide proof-of-concept (PoC) techniques. Let’s get started!

During the user registration process, websites often send a verification link to your email. If this link is sent over HTTP instead of HTTPS, it’s considered a vulnerability under certain conditions.