Noticed that if you enter "Null" as a last name, you register that a last name was entered but store the actual value as a Null type. Like the name : "John Null", cannot be saved in Marketo. I am trying to figure out how that would be possible and whether there is something exploitable here.
Yikes, that means the last name now has that character and won’t match expected conditions.
The problem is there isn’t a way to both have a character (byte or series of bytes)... yet not have it... at the same time.
What you can do is temporarily set the value to something like “\“Null\““ (the escaped quotes are on purpose), then run the people through a webhook that sets the value to the true string “Null“ (it is an allowed value when the API sends it, so it’s not that Marketo doesn’t allow it as a last name, just that it’s hard to get it in there!).
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.