Multiple RXSS

Hello Everyone, I am back with another write-up…

For 2–3 weeks I am busy with my exams. After finishing the exam I back to hunting. I decided to hunt on VDP which has a broad scope because in that bug hunting is easy.

I chose a program which is recently launched and has so many scopes. I picked up one domain. let’s call it <>.com

At first, I added it burp crawler (professional burp) and started it. After minimizing it I started exploring the website and I found an admin panel CMS that was vulnerable I was happy but is Authenticated.

Then i jumped to my Burp and guess what i found Multiple Reflected Cross-site scripting. YEAH, IT’S TRAIGED TIME. Before I reported it I was afraid because most RXSS are out of scope. Then I read and it’s not out of scope.

I reported it and after 4 hours I got a response. AAAH AS I TOLD YOU IT’S TRAIGED TIME. My report was valid and got triaged.

POC: <>.com/project/someting/fileame.html</sCrIpT><sCrIpT>alert(1)</ScRiPt>