Easy to check and find 3 different Bug on sign in and sign up.

1. No Password Policy

when you try to sign up for new account so check password area and simply put Password=12345678. if you sign up with this simple password means there no Password policy apply.

Step for check No Password Policy

POC and tips- read on Hackerone and bugcrowd

2. Weak Password Policy

when you try to sign up for new account so check password area and simply put Password=12345678. if you see any error like minimum password length 8 digit and use one upper and lower word and symbol. so you simply put there email id on password place. if you sign up with this email id as password means there weak Password policy apply

Step

Note- use inspect for see password in clear text.(right click on web page and click inspect . search password input area and change input type “password” to “text”) and see password area password in clear text.

POC and tips- read on Hackerone and bugcrowd

3. NO rate limiting

A rate limiting algorithm is used to check if the user session (or IP-address) has to be limited based on the information in the session cache. if client made too many requests within a given time frame.

HTTP-Servers can respond with status code 429: Too Many Requests

step

1. select login page and there is password forget option.
2. put email address and click on enter.
3. capture this request on burp and send to intruder .
4. go to intruder and Positions selection and click on clear
5. select on comment like -Accept-Language: en-US,en;q=0.$5$
6. go to payloads selection and payload type “Numbers” and payloads option type “sequential” From=1 and To=200 , Step=1
7. Click on start attack
8. few time after you check your inbox box receive 200 mail .
9. boom
10. DONE.

POC and tips - read on Hackerone and bugcrowd