HackerOne Bug Bounty Cross Site Scripting Vulnerability Poc

Hi, thanks for watching our video about Cross Site Scripting Reflected XSS Vulnerability Bug Bounty Poc in HackerOne Programs !

In this video we’ll walk you through:

- Open Redirect Vulnerability
- Cross Site Scripting Vulnerability
- Bypass Waf and Firewall Security
- Reflected XSS Vulnerability
- XSS Vulnerability

ABOUT OUR CHANNEL

Our channel is about Bug Bounty. We cover lots of cool stuff such as
Bug Bounty, Cybersecurity and Ethical Hacking
#bugbounty
#xss Vulnerability
#bugbountypoc
#bugsbunnychallenge
#bountyhunter
#bugbountytips
#bugbountyhunter
#bugbountypov
#bountychallenge
#hackerone
#bugbountyhuntingpoc
#vulnerability
Check out our channel here:

Don’t forget to subscribe!

CHECK OUT OUR OTHER VIDEOS

FIND US AT

[itsmdud]

wow that was amazing i never thought that we can have an xss with live search

[Squadron]

I can't understand how this payload is being exicuted could you please explain this

[xgreyhound]

smart but this would be a SXSS right? or are you able to enter it somehow to query considering you have to let it search and then add last > ?

[amoh]

i come from telgram channel new here how i can contact you im beginner i just have 2 qst need answer and i like how u explain to us the steps if step 1 dont work :) :D thanks

[anshulyadav]

Did they really gave you any bounty for this?
It is a Self-XSS according to them also, store is out of the scope of their Bounty list.

[hadhikhan]

Mean it's not encode in source code?

[jaredelfaz]

but can you please tell me how this can affect the user if there is no link displayed on the url during injecting the payload ? how can you send a link to a user and get their cookie or heart them in any way ?

[ayushmanngupta]

how did you craft the payload by analyzing from the source code or something else?

[laughing]

anyone help for finding admin panel of a website

[sintyiapurnamasari]

what is the danger of alerts? only shows popups?

[Harikrishnan_.]

Did they pay any bounty, it looks like self xss

[DEADCODE_]

broo i found another xss in this site man but i can't report it because i'm in Ethiopia so they don't want me to add my ethiopian phone number can you report it we can get good bounty

[RamGization]

Is there a way i can message or mail you.

[DEADCODE_]

Bro i tried this target and i got information disclosure through Graphql API but your xss the request was AjAX xhttprequest wow i didn't see that coming