Member-only story
✨$500 HTML Injection in Snapchat
🔗Free Article Link: Click Here
Hey, fellow bug hunters! Welcome to another exciting writeup in my bug bounty journey. My goal is to make these reports easy to understand, share the cool stuff I learn, and inspire others to dive into bug bounties. Whether you’re a pro or just curious, there’s something here for everyone! 💪
I’ll also drop some useful tips at the end of each report to help you level up your bug-hunting game. Let’s jump in!
🕵️♂️ Today’s Report: HTML Injection Vulnerability in Snapchat Newsroom
🚫 The Vulnerability: Unauthenticated HTML Injection
A researcher found an unauthenticated HTML injection vulnerability in Snapchat’s Newsroom section. The flaw was in the ?q= parameter of the search functionality, letting attackers inject arbitrary HTML code into the webpage.
Affected Endpoint:https://newsroom.snap.com/[code_country]/search?q=
Example Crafted URL:
https://newsroom.snap.com/es-ES/search?q=<a style="position:absolute;margin:50px;background-color:yellow;z-index:1000;top:50px;padding:100px;font-weight:bold;font-size:45px;color:red;" href="https://evil.com">Click here for win…
