BugBountyHunter

Summary

The goto paramater in the /login.php is Vulnerable to XSS. The input Provided in the goto parameter is reflected at the input tag

Finding the Payload

1) Understand the Scope where the Payload is Reflected .Since it is reflected inside an input tag we have 2 options 
a)Close the Input tag and create a new tag of your liking to trigger XSS 
b) use any Event Handlers to trigger the XSS without closing the input tag
2) I used option b)  found that some event handlers are filtered so used intruder to find the best event handler which can be used with minimum activity from victim. and found the onfocusin event handler
3) () where removed So used `` instead of ()
Final Payload irfan"%20%20onfocusin=confirm`1`%20autofocus>

Steps

1) Just Send this URL to the Victim

        https://05ecafffaada-0xirfan.a.firstbloodhackers.com/login.php?goto=irfan%22%20%20onfocusin=confirm`1`%20autofocus%3E

Impact

The XSS can be used to steal cookies which leads to ATO