DOM XSS

**You are viewing our old website - new website soon...!**

We are getting close to releasing BugBountyHunter v2 which will introduce a brand new website, including member platforms, new features, challenges, guides, videos, and the long awaited zseano methodology v2. Right now, all of the content on this website is considered out-dated, however our members section continues to operate for members.

Stay tuned for updates coming soon!

FirstBlood-#219 — DOM XSS
This issue was discovered on FirstBlood v1

This report has been reviewed and accepted as a valid vulnerability on FirstBlood!

On 2021-05-12, smhtahsin33 Level 3 reported:


        Hello,
Found a DOM xss on /register.php
Steps To Reproduce:

Visit http://firstbloodhackers.com:49585/register.php?ref=javascript:confirm();
Click on Return to previous page
The alert will pop up :D


Impact:
Javascript Code Execution

This report has been publicly disclosed for everyone to view

P3 Medium

Endpoint: /register.php

Parameter: ?ref=

Payload: javascript:confirm();

FirstBlood ID: 16
Vulnerability Type: Reflective XSS

The parameter "ref" is vulnerable to XSS on register.php. The developers failed to filter javascript: when used on "return to previous page"