HexBrain

Legal Robot · Report #271950

Improper Implementation of Password strength checker

Validstatus
5upvotes
10 Nov 2017disclosed

How it was found

Hi, I have seen Improper Implementation of Password strength checker for registration and login page. Once it suggest complex password, one can alter the password but the complexity remain the same Its usually related to Ajax or auto-reload implementation.

PoC

As a prof of concept see the attached picture, where the complexity says very high but with no password input.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original