$XX,000 Airbnb impossible XSS with 4 bypasses 

Thank you so much 😀

thank you for watching!

it seems like a really tough one so nothing to be ashamed of mate!

yeah, amazing!

congrats mate!

thanks for watching bro 👊

Im very happy you think so!

indeed! there are tons of different vectors and bypasses

thank you mate! 👊

Usually, you see at the first sight which response comes from WAF, as it usually has "Blocked by WAF" message or similar. In this case, the filter didn't cause 403 status, but it was standard 200 OK, but some parts from the user input were deleted.

thanks bro I will!

thank you buddy

I described a part of my Devtools workflow in "BYPASSING CLIENT-SIDE XSS FILTERS" that's in BBRE Premium archive ;)

👌

👌

its hackbar

thanks for watching!

👌

legendary comment

it's meaningless now. Is was there only for browser xss filter like chrome auditor. Auditor is no longer in modern versions of chrome.

@@BugBountyReportsExplained if we look at burp suite, there's an option to replace the response header which is the xss protection right? how do you do the PoC since the burp option only aaffect our browser. is that even make sense?

Great video, thanks for outlining all the steps! Am I wrong or html encoding HTML special characters on the waf or application side would have been enough to prevent the exploit?

you should make poc without any match&replace rules in burp so your POC is representative of a real attack

@Alessandro you not wrong, HTML encoding is simple, yet unbypassable way of mitigating XSS attacks

You can't.

well, that is a good question, but you should ask profession bounty hunters. I'm mainly a pentester and that's why I understand all this stuff, but Im not really actively doing bug bounties since I've started the YT channel.

@Oliver Yes , But how ? What is the Right pathway ?

Showing an alert box is an indicator that attacker was able to run javascript. Of course, alert is not malicious but being able to run javascript is. by running javascript, you can do a ton of things (basically everything that the frontend application would do) and some common techniques are to send the "victim's" cookie to an attacker, extract other information from the application and send it to the attackers, etc. xss is a client-side attack meaning that all those attacks are done towards another user by sending a malicious link to the "victim" if we are talking about a reflected xss or mass-targeting a lot of users that visit a specific page when we are talking about stored xss. the sky is the limit if your application suffers from xss.

As Yakushi responded, you can do whatever the victim can do on an attacked website and read all data that the victim can read.

i think the one visible on the screenshot is hackbar for firefox

@@BugBountyReportsExplained thanks dude

👊

Poland

@@BugBountyReportsExplained ok bro cool

@@BugBountyReportsExplained tego sie nie spodziewałem. Pracujesz jako pentester na etacie czy zajmujesz się profesjonalnie bug bounty?

what is demo?

@@BugBountyReportsExplained i mean work in website

thank you buddy 😊

i'd go for: 1) python or other scripting language where you will be able to write some scripts if you need 2) write some web applications to understand the developer side of things 3) some knowledge about bash or equivalent

siema!

There are english subtitles for this video and for most of them

😊😊

it definately looked like the end. That's what I like about this report the most!