DinDinDin

Bug Hunter | Never give up ...

[DinDinDin @comores_11]

XSS Tip : Target error parameters on shopping cart pages. 🛒

- Find the checkout URL

- fuzz for error, msg, err, ...

- Test for reflection : ?error=XSS&msg=XSS&err=XSS....

Often, these parameters bypass standard encoding.

#BugHunting #HackingTips #XSS

[DinDinDin @comores_11]

#Infosec #WebSecurity #BurpSuite #BugBounty #Pentest

[DinDinDin @comores_11]

On SPA apps (React/Vue/Angular), use Burp Match & Replace to swap all "false" to "true" in JSON responses.

The result ? Hidden admin panels, debug modes, and restricted UI features can appear. 🔓

Don't just test the API, explore the UI! 🛡️

#Infosec #WebSecurity #BurpSuite #BugBounty #Pentest

[Anton @therceman]

How to bypass WAF on HTML tag with attributes. Another great scheme by @hackerscrolls. #infosec #CyberSecurity #bugbountytip #ethicalhacking

[DinDinDin @comores_11]

🔥 XSS Tip: Raw HTML response vs Browser DOM

When a XSS payload is reflected and filtered in a HTML response, always verify it in the DOM as well.

Why? In the raw HTML response, your payload might look safely filtered or encoded. However, once it reaches the DOM, it can still execute due to JavaScript processing (client-side rendering).

Don't just trust the raw bytes in Burp — trust the DOM 🔍!

#BugBounty #XSS #Pentest #Infosec #WebSecurity #BurpSuite

[DinDinDin @comores_11]

🔥 XSS Tip: Unicode Normalization

Don't give up if <, >, " or ' are filtered ! Many apps normalize Unicode after the WAF/security layer.

Some bypass variants (URL-encoded):
🔹 < ➔ %EF%BC%9C
🔹 > ➔ %EF%BC%9E
🔹 " ➔ %EF%BC%A2
🔹 ' ➔ %EF%BC%87
🔹 ` ➔ %EF%BD%80

For example, inject %EF%BC%9Cscript%EF%BC%9E and check if it reflects as <script> in the DOM.

Automate these quirks with recollapse : https://t.co/bHlpRNB0tK

#BugBounty #BugBountyTips #XSS #Pentest #Infosec #CyberSecurity

[DinDinDin @comores_11]

🛡️ #XSS Tip :

1️⃣ Spot a data-.... tag in the HTML response.

2️⃣Example: <div data-user-id="123">

3️⃣ Test the prefix as a new GET/POST param: ?user=REFLECTED or userId=REFLECTED

4️⃣ Result: <div data-user-id="REFLECTED">

The prefix is often a hidden reflected param name ! 🔥

#BugBounty #Infosec #WebSecurity #Pentest #BugBountyTips

[DinDinDin @comores_11]

Honored to be among the Top Performing Hunters in 2025 on YesWeHack🏆

Really happy to hunt on YesWeHack — great platform and great experience

#CyberSecurity #BugBounty #YesWeHack #XSS

[DinDinDin @comores_11]

Happy to have been rewarded for discovering a hidden XSS vulnerability with Onetest, a new tool for discovering hidden XSS !

Curious to test it out ? Join the Discord and give it a try : https://t.co/pJ74EanUnG

#XSS #BugBounty #WebSecurity #Onetest

[Edra @0xEdra]

Onetest Extension is now in free beta. Join our Discord for the download link, install guide and your API key. Tell us about any bugs and share ideas for improvements.
https://t.co/UXVScjE7HU

#BugBounty #XSS #OneTest

[Edra @0xEdra]

Join the OneTest Discord! The XSS extension is running a bit late, but we’re working hard to ship the beta ASAP. Check out this quick demo video, all updates and test-lab access will be shared there. See you inside! 👇

https://t.co/UXVScjE7HU

[Edra @0xEdra]

I think I've found 70% of my XSS vulnerabilities automatically in BBP with a tool. I think it can be useful for bb hunters and pentesters. I'll give details of the tool and a test phase in the next few days.

What’s your goto method to find XSS quickly?
Stay tuned 👇

[Edra @0xEdra]

1/6 Tired of manually testing every parameter hoping to find an XSS?
Yeah us too. It's time-consuming, repetitive, and let's be honest, not the most exciting part of the job.

So we built a Burp Suite extension @onetestfr to automate the entire process (Caido coming soon).

[DinDinDin @comores_11]

Rewarded for multiple XSS in bug bounty 💰Found them with Onetest — the upcoming tool made for XSS hunters. It’s clean, fast, and built to find what others miss. Coming soon 👀#bugbounty #xss #Onetest #infosec

[DinDinDin @comores_11]

💡 Bug bounty - XSS Tip : Found a vulnerable GET parameter? Always check its context in the response! 🔍

Example:

If the GET param name is vulnerable and shows up in <script> _cq.name = '[INJECTION]'..., test all param names after _cq. across every response ! You could discover more hidden XSS! 🚀💥

#BugBounty 🐞 #CyberSecurity 🛡️ #WebSecurity 🔒 #AppSec 📱 #InfoSec 🔐

[DinDinDin @comores_11]

💡 XSS Tip : If you find a vulnerable parameter on your target, test all parameters with a similar name structure!

Example:

Vulnerable param found : "user_name"

Test all params starting with "user_" ! 🎯💥

#BugBounty 🐞 #CyberSecurity 🛡️ #Infosec 🔒 #AppSec #BugBountyTips

[DinDinDin @comores_11]

💡XSS Tips: When dealing with WAFs 🔥, try combining multiple parameters if possible to form your XSS payload 💥. This trick can help you bypass filters and trigger the vulnerability! I’ve had great success with this technique !

#BugBounty #XSS #BugBountytips #WebSecurity

[DinDinDin @comores_11]

🚨XSS Tips : When a param is filtered by the WAF, try adding the same parameter multiple times in your request ! 🔄 This can lead to surprising and unexpected results, potentially bypassing the WAF :) ! 🔥

#CyberSecurity #XSS 💥 #WebSecurity #HackingTips 🧠 #BugBounty

[DinDinDin @comores_11]

@im_crazy26 Yes, on other endpoints where the response has a text/html content type,

[DinDinDin @comores_11]

💡 XSS Tips: When requests return a JSON response , always test XSS payloads on the parameters sent in the request! They can be reflected on other pages, leading to vulnerabilities ! 💥 I’ve found plenty of XSS this way 🚀 Stay sharp ! #BugBounty #XSS #CyberSecurity #WebSecurity