Xiety

Securing the internet one bug at a time :) | Top 25 @YesWeHack | Founder Of @BountyBrief

[Xiety @_Xiety]

@thedawgyg @Shabosec Check your dm bro @thedawgyg

[Xiety @_Xiety]

Fingers crossed

@thedawgyg

[Xiety @_Xiety]

@iamvishalll__18 @thedawgyg A doubt about what

[Xiety @_Xiety]

@PhiloGroves @thedawgyg Ill test some luck because its unique! But I appreciate you bro

[Xiety @_Xiety]

Does apple pay for DoS findings?

@thedawgyg

[Xiety @_Xiety]

@thedawgyg Fuzzer picked up a null pointer dereference trying to reproduce the poc now

[Xiety @_Xiety]

@mrdami3n @yeswehack Thank u bros!

[Xiety @_Xiety]

Just got a reward for a high vulnerability submitted on @yeswehack -- Cleartext Storage of Sensitive Information (CWE-312). https://t.co/wAKPXV10cr #YesWeRHackers

[Xiety @_Xiety]

@DuckyWantDucky @yeswehack thanks bro

[Xiety @_Xiety]

Just got a reward for a vulnerability submitted on @yeswehack -- Use of Unmaintained Third Party Components (CWE-1104). https://t.co/wAKPXV10cr #YesWeRHackers

[trace37 @trace37_labs]

Woke up this morning thinking "It's Thursday — no XSS reported this week...

... what will I do for PAYLOAD OF THE WEEK?"

Started on a new target last night. Woke up VERY early and found this:

Confirmed DOM XSS → theoretical ATO (still working on that!). Cloudflare WAF bypassed.

The bypass is the interesting part:

onerror=alert(1) → 403
onerror%0c=alert(1) → 200

Note: one character: %0c is a form feed.

Cloudflare matches onerror= literally. The HTML spec treats form feed as whitespace — so onerror\x0c= is a valid event handler that CF never sees.

Once past the WAF, the XSS chain was wide open:

- URLSearchParams → Vuex store → v-html / innerHTML
- No sanitisation at any step.
- CSP was report-only — never enforced, so nothing blocked execution.
- Confirmed in all browsers. No auth required.
- Single link from the browser.

Sanitised explanation in the image - plus time-stamped ALERT from just moments ago. You're watching XSS live!! Report to h1 almost drafted but on hold as I look to escalate to full ATO.

Things worth adding to your methodology:

1. When a WAF blocks your event handler, try whitespace variants before moving on. Form feed, vertical tab, null byte. CF won't always catch them.
2. Vue apps using v-html are worth tracing. It compiles straight to innerHTML. Follow the data into the store.
3. If you see Content-Security-Policy: ... report-only — that's not protection. That's a log file 😄

[Xiety @_Xiety]

My nana is trying to win the fight against stage 4 cancer. Anything helps. Share or a donation helps us out tremendously.

https://t.co/z0On2i8xlK

[Xiety @_Xiety]

@EvanKlein338226 Everything I submit rn is getting closed

[Xiety @_Xiety]

Great way to start the day with a Critical IDOR as Informative!

[Xiety @_Xiety]

@EubardWells @_MrPlanB @yeswehack I might have too lol

[Xiety @_Xiety]

@Cachorroexausto Tempting some days.

[Xiety @_Xiety]

@_MrPlanB Just a better way to say get scammed, We will fix it and not reward lol used to it.

[Xiety @_Xiety]

@_MrPlanB “Known issue” but its not written in the known issues on the program so Im confused

[Xiety @_Xiety]

@EubardWells @intigriti Too bad my findings are all manual!

[Xiety @_Xiety]

I have an endpoint where I can inject malicious content into a QR code. Inject and pre-fill messages to numbers which is a toll rate number I can set up. Also I can redirect to a malicious site, make the user call a number etc.

Impactful?! @intigriti Triage says no. LOL