Bypass of Username Policy Breaking the Rules with a Simple Trick

Posted Jun 5, 2025 Updated Sep 23, 2025

Bypass-of-Username-Policy-Breaking-the-Rules-with-a-Simple-Trick — blog writeup cover

By Mohamed Mahmoud

1 min read

Bypass of Username Policy — Breaking the Rules with a Simple Trick

Late one evening, I decided to dive into some bug hunting for a quick session. I noticed the application had strict username rules during registration — special characters like @@ or ... or numeric-only usernames like 123 were not allowed. Also, I couldn’t change my username after signing up. It seemed solid.

Process

I registered normally and went to my profile settings. However, the option to change my username was disabled.

Exploit

I didn’t stop there. I decided to change my bio and intercepted the request using Burp Suite.

While reviewing the request, I spotted that I could add a parameter that doesn’t exist in the normal request — and it allowed me to modify my username.

After I added the parameter, I sent the request again, and it just worked!