Self-XSS in Facebook payments flow leads to Instagram and Facebook account takeovers
XSSAccount TakeoverFacebook$62.5k9mo ago
Self-XSS chained through the payments flow into full Instagram/Facebook ATO.
Youssef Sammouda · ysamm.com ↗The ledger
Bounty writeups.
Real disclosed-bounty writeups — every entry states a real bounty, verified live against the article before it's listed. Dead links are dropped automatically.
44 writeups · $585.5k in bounties · checked today
Apple Developer Stored XSS — $5,000 Bounty
XSSApple$5k11mo ago
Stored XSS on Apple Developer — persistence + escalation explained.
Youssef Desouki · Medium ↗How I found a $5,000 Google Maps XSS (by fiddling with Protobuf)
XSSGoogle$5k9y ago
The legendary Protobuf-fiddling XSS — a masterclass in parameter digging.
Marin Moulinier · Medium ↗How I Earned $1750 at Shopify Bug Bounty Program
XSSShopify$1.8k6y ago
Critical stored XSS in Shopify Core — full report included.
Ashish Dhone · Medium ↗Every bounty amount, date and link was verified against the original article before listing; articles are re-checked every 24 hours and dropped if they go offline. Content belongs to the original authors.