Bug Bounty Hunting Essentials

Stored cross-site scripting

I will describe this kind of XSS, using a personal example from a past job. In order to understand, as in the first case, the way to exploit this vulnerability and its impact.

Around a year ago, I was working in a digital advertising agency; where there was an internal application with a lot of forms to create customer profiles and marketing campaigns.

There I was working as a QA engineer, and for one of my functional tests, I used the Intruder tool in Burp Suite to insert a list of values into the application's fields. Also, I added this string:

    '><script>alert(1)</script>

But, I kept in mind that this simple string attack may not work because in this company, the developers were using Laravel. Laravel is a PHP ...