1 posts across writeups, research, and technical deep-dives. Filter by tag.
I found my first DOM-based XSS in a bug bounty program. No SQLi, no RCE - just a missing origin check in a postMessage listener and a javascript: URI. CVSS 9.0. Sink-to-source analysis, exploit chain, and some bonus impact.
