Tale of my First XSS

Hi guys, So I would like to start this blog with a question, What was the first vulnerability you learnt when you began into Cyber Security??

Mine was XSS, though it took pretty long for me to find it but yeah! I finally found it ¯\_(ツ)_/¯

Case Study

I got an invitation to a private program on HackerOne. It almost had more than 600+ reports already reported with just 4 assets. Damn will I find anythin’??
I still began with my normal reconnaissance and started playing with the application. No luck here!

Now, I then started mining the parameters. HOW? here you go

GitHub - devanshbatham/ParamSpider: Mining URLs from dark corners of Web Archives for bug hunting/fuzzing/further probing

Cihan Mehmet DOĞAN (CMD) on Twitter

@marcolivermunz @hahwul you can use it as below. gospider -S tageturls.txt -c 10 -d 5 --blacklist ".(jpg|jpeg|gif|css|tif|tiff|png|ttf|woff|woff2|ico|pdf|svg|txt)" --other-source | grep -e "code-200" | awk '{print $5}'|grep "=" | qsreplace -a | dalfox pipe -o result.txt

• GitHub - s0md3v/Arjun: HTTP parameter discovery suite.
• GitHub - hakluke/hakrawler: Simple, fast web crawler designed for easy, quick discovery of endpoints and assets within a web application

also you can use “Waybackurls | gau” to find parameters. These are some great tips I have used soo far and the results were amazing ¯\_(ツ)_/¯

With all the list of Parameters, I started fuzzing and fuzzing with a thought, I’ll get something interesting (Positive Vibes) and Voila!! I found one parameter which did not have many filters. First I sent it to some XSS scanner tools because It’s the first time I running for an XSS.

• GitHub - s0md3v/XSStrike: Most advanced XSS scanner.
• GitHub - hahwul/dalfox: 🌙🦊 Dalfox is a powerful open-source XSS scanner and utility focused on automation.

And I got positive results, I found csrfToken lying out there for me lol :P

https://sub.example.com/?csrfToken=htmhunter

So I started exploring how to get the POP-UP

And later that day. I reported my First XSS on HackerOne.

Takeaways –

“Old program, many reports, and many such things” don’t let it bother you. Always try to find more and more parameters and Fuzz them ALL :D

That’s all for this blog. Hope you liked it.

Connect with me on LinkedIn, Twitter

If you enjoyed this blog, please click the 👏 button and share it to help others find it.