#NahamCon2022 - @zseano Finding XSS on .apple.com and building a proof of concept to leak your PII
Outlines #NahamCon2022 - @zseano Finding XSS on .apple.com and building a proof of concept to leak your PII and evaluates key implications for security practitioners.
Summary
## Collaborative Apple Bug Bounty
zseano recounts a BugBountyHunter community event targeting apple.com, inspired by Sam Curry's earlier research. The group prioritized finding any valid vulnerability over a preset bug class, learning the attack surface organically.
## Recon and Enumeration
Recon combined public write-ups with custom PHP scripts run through Burp Intruder to probe hosts and endpoints. Many Apple properties respond only to mobile User-Agent strings, so desktop browsers miss vulnerable surfaces iPhone clients expose.
## Finding and Weaponizing XSS
The team landed cross-site scripting and debated impact paths: session cookie theft, sensitive actions on behalf of users, or PII disclosure. Most session cookies were well locked down, limiting classic account takeover.
## Proof of Concept: PII Leak
They chose to demonstrate personal information disclosure—a high-impact, report-friendly outcome for bounty training. zseano emphasizes teaching collaborators not just to find bugs but to build convincing proofs that show real user harm.
Related talks
Main Stage·44 min
Cybertiger · Colonel Panic · The Wrew
Cybertiger, Colonel Panic, and The Wrew introduce low-cost counter-surveillance hardware built around the ESP32 to detect tracking devices.
Main Stage·46 min
Bill Swearingen
Bill Swearingen explores whether adversarial patterns printed on everyday clothing can effectively fool commercial and municipal facial recognition algorithms.
Videos·42 min
Presenters detail vulnerability discovery and exploitation in Adversary Tracking And All The Lies We Tell Ourselves by Joe Slowik.