🚨Bug Bounty Tip: Test Newline Injection in JSON Parameters

When testing API endpoints, don’t assume parameters like email accept only a single value.

For password-reset functionality, try newline injection:

{
  "action": "reset-password",
  "email": "accA@mail.com\naccB@mail.com"
}

If the backend fails to properly validate or sanitize the parameter, it may interpret both email addresses as separate recipients and send the password-reset link to both accounts.

This can indicate a parameter parsing / input validation flaw and, depending on the application logic and impact, potentially lead to account-related security issues.

Things to test:
• \n and \r\n separators
• Multiple values in the same parameter
• JSON arrays vs. strings
• Duplicate JSON keys
• URL-encoded newline characters
• Different API content types

Always test only on systems you’re authorized to assess.

#BugBounty #BugBountyTips #API #APISecurity #WebSecurity #Pentesting #CyberSecurity