Bug Bounty Journey — Valid Report Part 3
In this journey, I will share my experience with a valid report I submitted. This will be a series until I discover new vulnerabilities. 😊
Let’s begin!
It was a private VDP program with no wildcard; it only had a few domains. I chose the main application and tried a manual approach.
I prefer this over working with wildcard programs. :)
Let’s call it example.com.
My intention before I started was to try to find business logic issues, email verification bypasses, and maybe even account takeover vulnerabilities.
Anyway, I started exploring the application. I tried what I knew, but in the end, I didn’t find anything, unfortunately.
Get 0xF3r4t’s stories in your inbox
Join Medium for free to get updates from this writer.
After all this, I checked my Burp Suite history and found an endpoint like:
example.com/endpoint/anotherendpoint?id=11111
I visited this URL and noticed the id parameter was reflected. I tried injecting some characters to check for reflected XSS, but no luck.
I attempted several payloads manually but couldn’t trigger XSS.
There was a WAF, so I couldn’t trigger XSS. :(
Instead, I only managed to trigger HTML injection.
I felt a bit sad, but there was nothing more to do. I submitted it as an HTML Injection and it was accepted as low severity.
It was a popular app worldwide, so I didn’t expect to find anything major — so, not bad. :)
