// archive
Tag: Web Security
A Tricky Open Redirect – Filter Bypass
// TL;DR One of my favourite little findings. A private Bugcrowd program had a login?nextUrl= redirect parameter that rejected the usual open-redirect payloads. A random test…
Stored XSS in Tumblr
// TL;DR Back when I started in bug bounty in 2017, I found a stored XSS vulnerability in Tumblr. I reported it, the security team patched…
Stored XSS in eBay’s Sell Page
// TL;DR I found a cross-site scripting vulnerability on eBay, in the “add photos” field of the Sell page. A simple image-based payload with an event…
Multiple Stored XSS in EmailMeForm
// TL;DR I found multiple stored XSS vulnerabilities in EmailMeForm, a popular online form and survey builder. The same root cause showed up in three different…
Content Injection in Instagram’s Password-Reset Page
// TL;DR I found a content injection (content spoofing) issue on Instagram’s password-reset confirmation page. A query parameter on the page was reflected directly into the…
What Is User Enumeration?
// TL;DR User enumeration is a flaw that lets an attacker figure out which usernames, emails, or phone numbers are registered on a system — usually…
My First XSS: Two Stored Bugs in Displaybit
// TL;DR Displaybit is a site that pays users for uploading and sharing images, and I found my first-ever XSS there in about two minutes —…
What Is Cross-Site Scripting (XSS)?
// TL;DR Cross-Site Scripting (XSS) is one of the most common web vulnerabilities on the internet. It lets an attacker get their own JavaScript running in…