Turning a $500 bounty into $30,000+

### Overview In this talk, the speaker explains how security researchers and bug bounty hunters can escalate standard Cross-Site Scripting (XSS) findings beyond simple `alert(1)` proof-of-concepts to demonstrate maximum critical impact. While an `alert(1)` confirms arbitrary JavaScript execution in a victim's browser, relying on it often results in standard or medium-severity payouts. The presentation outlines three key techniques to turn routine XSS findings into critical account takeovers and higher bug bounties, highlighted by the speaker's real-world experience turning an XSS into a $30,000 bounty during a HackerOne live hacking event.

### Key Topics - **Limitations of Traditional XSS Impact:** The default assumption that an attacker can easily dump session cookies via `document.cookie` often fails in modern web applications due to expiration policies, cookie restrictions, and rapid rotation. - **Technique 1: Session & Cookie Extraction:** The conventional method of dumping cookies and sending them to an attacker-controlled listener, while common in legacy applications, often lacks maximum impact today. - **Technique 2: Modifying Account Data or Adding Organization Users:** Exploiting application workflows without direct cookie access by changing user details (e.g., swapping email addresses and immediately triggering password reset flows) or adding attacker-controlled administrative users to SaaS organizations. - **Technique 3: API Token and Key Exfiltration via Background Requests:** Monitoring network calls (such as `/api/me` or `/me`) to identify endpoints that return sensitive JSON data, JSON Web Tokens (JWT), or API keys, and scripting background requests to exfiltrate these credentials. - **Real-World Escalation Case Study:** An account of how an initial reflected XSS was chained with a Content Security Policy (CSP) bypass and a legacy API endpoint leaking API keys during a live hacking event, turning a basic finding into a $30,000 critical reward.

### Technical Details To demonstrate credential exfiltration, the speaker walks through a lab environment featuring a modern web application architecture: - **Inspecting Background Calls:** Opening the browser's Network tab reveals that loading the profile sends an asynchronous request to `/api/v1/api/me` (or `/me`), which returns a JSON object containing the user's name, email status, a JWT token, and an API key. - **Crafting the Payload:** Instead of calling `alert(1)`, a custom JavaScript snippet is constructed using an `XMLHttpRequest` (or alternatively `fetch`) to issue a GET request to the internal `/me` endpoint. An event listener parses the JSON response, extracts the target `JWT` value, and transmits it via an outbound HTTP request to an external server controlled by the attacker (such as an interact.sh server, Burp Collaborator, or Apache server). - **Payload Delivery:** The JavaScript code is Base64-encoded and wrapped inside an `eval(atob(...))` payload. Injected into the vulnerable input via Burp Suite, the script executes in the victim's session, queries the authenticated API endpoint, and forwards the sensitive JWT token to the attacker's listener.

### Takeaways - **Never Stop at `alert(1)`:** Submitting a basic alert often results in an implied medium impact; investing extra time to demonstrate tangible harm like account takeover drastically increases bounty severity and payout. - **Inspect Sensitive Workflows:** Test whether sensitive operations—such as updating an email address—require current password confirmation. If not, chain the email update directly with a forgot-password request. - **Examine API Responses:** Thoroughly audit the network traffic of modern single-page and API-driven applications to identify legacy or standard endpoints that expose JWTs or authorization keys capable of granting complete API access.