Security Test : If web application has create user / register user functionalities:

1. In this type of scenario we can try many tricks and can learn about application’s create user mechanism.
1. First scenario
1. Check what type of cookies application holds.
2. If application has a cookie on the username then we can simply replace username with admin in the cookies and it will give us the admin session.
2. Second scenario:
1. Sometimes application has cookies encrypted with weak algorithm (MD5).
2. Decrypt the cookies and if it holds username then encrypt admin with same algorithm (MD5) and paste in the cookies.
3. It will give the admin session.
3. Third scenario:
1. While creating username in the application we can directly try to create admin user sometimes.
2. Sometimes database does not compare the case sensitive values so if we create user “aDMin” instead of admin (which is already exist), it will give us “admin” login.
4. Fourth scenario:
1. We can also check for one more improper username validation.
1. If admin user is already available in the application and application does not allow you to create admin user.
2. Try to create user “admin ” (admin with whitespace), database again will provide admin to you.