// archive
Tag: Stored XSS
XSS Like a Pro: Beating Filters Across a Private Program
// TL;DR A private Bugcrowd invite, one in-scope test site, and a set of provided credentials. It turned into eleven vulnerabilities in a single session —…
Stored XSS via Email Reply (H1C Private Site)
// TL;DR This is one of the trickier XSS bugs I’ve found. The target was an email-marketing platform, and the injection point wasn’t a web form…
Stored XSS via Form Submission (Jotform & an H1C Private Site)
// TL;DR I found a stored XSS that fires through the submission side of a form builder: an attacker fills out someone else’s form with a…
Stored XSS in Tumblr
// TL;DR Back when I started in bug bounty in 2017, I found a stored XSS vulnerability in Tumblr. I reported it, the security team patched…
Stored XSS in eBay’s Sell Page
// TL;DR I found a cross-site scripting vulnerability on eBay, in the “add photos” field of the Sell page. A simple image-based payload with an event…
Multiple Stored XSS in EmailMeForm
// TL;DR I found multiple stored XSS vulnerabilities in EmailMeForm, a popular online form and survey builder. The same root cause showed up in three different…
My First XSS: Two Stored Bugs in Displaybit
// TL;DR Displaybit is a site that pays users for uploading and sharing images, and I found my first-ever XSS there in about two minutes —…