Guest
Don't you hate it when you find an XSS on an out-of-scope subdomain while bug bounty hunting? Worry not, this presentation will cover how to turn that out-of-scope XSS into a valid bug bounty report. Having some success in maximizing the impact of HTML injections on subdomains, I wanted to share the technical details behind my process. I will discuss abusing cookie specifications and browser/server tricks to achieve session fixation, OAuth token leaks, site-wide CSRF, and many more client-side issues. Real-
