Finding XSS Through HTML Injection — Without Fuzzing Tools Note: All sensitive information has been redacted When hunting for XSS, most people immediately reach for fuzzing tools. But sometimes …

InfoSecWriteUps' platform is  dedicated to providing insights and resources for cybersecurity professionals and enthusiasts. Through articles, tutorials, and security research, InfoSecWriteUps offers insights into cybersecurity vulnerabilities, attack techniques, and defense strategies. Readers can learn about penetration testing, threat intelligence, and incident response to enhance their cybersecurity knowledge and skills.

InfoSec Write-ups

A bug bounty writeup demonstrating how XSS was discovered through manual observation rather than fuzzing tools. The researcher spotted an anomalous .php endpoint in a modern framework app, confirmed HTML injection with a basic tag, then bypassed a keyword-based WAF by substituting the blocked `<script>alert(1)</script>` payload with `<svg onload=confirm(1)>`. The vulnerability was reported and fixed.