---
title: "Discussion on \"Puny-Code, 0-Click Account Takeover\" | Hashnode"
description: "Discussion on \"Puny-Code, 0-Click Account Takeover\". Puny-code inconsistencies can enable account takeovers by exploiting character parsing vulnerabilities, affecting email servers and databases"
url: "https://hashnode.com/posts/puny-code-0-click-account-takeover/683c9a2ff557a5abd59dc8b9"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Puny-Code, 0-Click Account Takeover](https://blog.voorivex.team/puny-code-0-click-account-takeover?utm_source=hashnode&utm_medium=feed)

Puny-code inconsistencies can enable account takeovers by exploiting character parsing vulnerabilities, affecting email servers and databases

Jun 1, 2025 · 7 min read · blog.voorivex.team  
Read the article

-   [#puny-code](https://hashnode.com/tag/puny-code)
-   [#account-takeover](https://hashnode.com/tag/account-takeover)
-   [#oauth2](https://hashnode.com/tag/oauth2)

## Written by

[Voorivex](https://hashnode.com/@Voorivex)

@Voorivex

  
[View profile](https://hashnode.com/@Voorivex)

@yshahinzadeh

I work as an instructor and hunter, leading a small team to grow, learn, and innovate.

## Responses 6

Markdown supported · ⌘↵ to post

[13erCheng F10wers](https://hashnode.com/@huahua)

[Oct 20, 2025](https://hashnode.com/posts/puny-code-0-click-account-takeover/683c9a2ff557a5abd59dc8b9/comment/68f606c01da47373a9b05ce9)

very good

[swaroop venkat](https://hashnode.com/@swaroop514)

[Jul 29, 2025](https://hashnode.com/posts/puny-code-0-click-account-takeover/683c9a2ff557a5abd59dc8b9/comment/68881dfc2cf922f113cbf58f)

Great One.

[Sri W](https://hashnode.com/@chen11)

[Jun 23, 2025](https://hashnode.com/posts/puny-code-0-click-account-takeover/683c9a2ff557a5abd59dc8b9/comment/6858f21e808c080774d45ae4)

6

[Navid Navid](https://hashnode.com/@navid-rezaei)

[Jun 3, 2025](https://hashnode.com/posts/puny-code-0-click-account-takeover/683c9a2ff557a5abd59dc8b9/comment/683eebd661cd2d4649610e9c)

Nice trick I use this to get account take over in my university but The database used in university is Microsoft sql server and its accent-sensitive by default 😔

[m1k0er](https://hashnode.com/@m1k0er)

[Jun 2, 2025](https://hashnode.com/posts/puny-code-0-click-account-takeover/683c9a2ff557a5abd59dc8b9/comment/683d62d972a918ead734c370)

Thank you for sharing. I have a question for you. In the "Forgot Password section", you registered the SMTP service of victim@gmàil.com to get the victim's reset link, right? How can I register an SMTP service similar to gmàil.com?

[Sam 499](https://hashnode.com/@SmFisher)

[Jun 3, 2025](https://hashnode.com/posts/puny-code-0-click-account-takeover/683c9a2ff557a5abd59dc8b9/comment/683d62d972a918ead734c370#reply-683e71a24df4c09afba9cd96)

I also have the same question.

[Navid Navid](https://hashnode.com/@navid-rezaei)

[Jun 3, 2025](https://hashnode.com/posts/puny-code-0-click-account-takeover/683c9a2ff557a5abd59dc8b9/comment/683d62d972a918ead734c370#reply-683eec0a5ab617b38efd3013)

By domain and create emai server

[rootface](https://hashnode.com/@root-face)

[Jun 2, 2025](https://hashnode.com/posts/puny-code-0-click-account-takeover/683c9a2ff557a5abd59dc8b9/comment/683d36c3d427aab4346e0d37)

amazing , do its smart!