🔁 XSS can (on some occasions) be escalated into an SSRF! That's at least when a PDF generator is incorrectly implemented... 👀 In our comprehensive article, we show you exactly how you can start hunting for injection vulnerabilities in PDF generators to achieve SSRF and leak
Scan Git orgs 4 secrets: /(?i)(password|passwd|pwd|secret|token|apikey|api_key|access_key|secret_key|access_token|api_secret|apiSecret|app_secret|application_key|app_key|appkey|auth_token|authsecret)\s*=\s*["'][^"']{4,}["']/ AND org:adobe AND NOT language:Markdown NOT is:archived
New XSS Bypass Cloudflare WAF 🧱 Payload : %3CSVG/oNlY=1%20ONlOAD=confirm(document.domain)%3E #BugBounty #XSS #Cybersecurity
If you need to quickly spot reflected params for XSS hunting, you should check out @TomNomNom’s kxss! It identifies parameters that are reflected in responses and shows you which characters (" ' < >) get through! (🔗 link in comments)
- First Bounty Roadmap is free - PortSwigger Labs is free - PortSwigger Academy is free - Burp Community is free - HackerOne is free Everything you need to start bug hunting is free.