How Hidden 3xXSS got revealed

15 hours ago 8

BOOK THIS SPACE FOR AD

ARTICLE AD

Just now

--

During VAPT sprint I started Exploring the Application as normal

I decided to start parameter fuzzing parameters as a part of my Reconnaissance and Application Mapping Methodology

I started with login.php

using Param Miner with Guess Every thing

Got msg param on the login page

Explored the parameter and How it works

much closer

So I Decided to start with Injecting uncommon XSS payload<details open id=ds\\ ontoggle=alert(1)>`

And Bingooooooo XSS works after Clicking

For the Rest 2 XSS
they are found with the same parameter in

home.php dashboard.php

Read Entire Article