How I Discovered Account Takeover (ATO) via Cross-Site Scripting (XSS)

Free Article

Hello everyone,

Today, I want to share my experience of discovering an account takeover (ATO) vulnerability through Cross-Site Scripting (XSS). Let’s dive right in!

While hunting for a program with millions of users — specifically a large blog website, which I’ll refer to as redacted.com — I began by enumerating its subdomains. One subdomain I found was jp.redacted.com.

Next, I utilized Param Spider to gather all possible parameters. The command I used was:

This command listed all possible parameters in the terminal. Among them, I discovered a parameter called s=, which allowed me to execute reflected XSS (RXSS) with a simple payload:

Once I got I tried to escalate it to the ATO using a simple payload

However, this approach did not work, and I tried numerous payloads without success. After some experimentation, I decided to encode my payloads in Base64…