We are getting close to releasing BugBountyHunter v2 which will introduce a brand new website, including member platforms, new features, challenges, guides, videos, and the long awaited zseano methodology v2. Right now, all of the content on this website is considered out-dated, however our members section continues to operate for members.
Stay tuned for updates coming soon!
FirstBlood-#427 — Reflective XSS at /login.php
This issue was discovered on FirstBlood v2
On 2021-10-25, d20s84 Level 3 reported:
Getting started
Learn about vulnerability types 
Getting started in bug bounties 
Test your knowledge
Free Web Application Challenges
Guides for your hunts 
ZSeano's Methodology
Effective Note Taking for bug bounties
Useful Resources 
Disclosed HackerOne Reports 
Our community
Endorsed Members
Hackevents 
Member Articles
Hi Sean! Hope you are doing well!!
I found a reflective xss on the doctor login page.
Summary:
Javascript could be in injected into the /login.php endpoint through a hidden parameter leading to reflective XSS.
Steps:
- Look into the source Code. There is a hidden parameter named goto .
- Craft the URL with goto as a query string.
- Submit the above provided payload and hit Enter.
4.Boom! The payload triggers!!
Impact:
Cross site scripting can lead to various devastating attacks such as stealing cookie for user impersonation and many more.
Image below shows the triggered payload.
**Image below shows how the website looks after the ok button to the alert box is pressed.
P3 Medium
Endpoint: /login.php?goto={payload}
Parameter: goto=
Payload: "><scr<script>ipt>alealertrt`1`<%2Fscr<%2Fscript>ipt>
FirstBlood ID: 26
Vulnerability Type: Reflective XSS
The developers thought they had fixed ?goto= when reflected in an input tag on login.php from a similar bug (ID 39), but because this endpoint uses legacy code their changes were not applied here and thus the XSS was forgotten.