Open Bug Bounty Community Forum

when will they be approved?

approved

thanks, what about XSS in *.worldbank.org (need to click 'here' to trigger) and XSS in *.hsbc.com?

approved

Does the Mcafee and Chase one leverage the open redirect?

Just wondering since I submitted open redirects for both domains you found.

Looks like a pattern here -

Thanks @admin
And yep it's leveraging a redirect via a data: uri w/ b64 encoded input

ret2libc wrote:Thanks @admin
And yep it's leveraging a redirect via a data: uri w/ b64 encoded input

So they're basically duplicates of mine?

Or should I go through and do this for all the open redirects I submitted?

if redirect via js we accept xss

Spam404Online wrote:

ret2libc wrote:Thanks @admin
And yep it's leveraging a redirect via a data: uri w/ b64 encoded input

So they're basically duplicates of mine?

Or should I go through and do this for all the open redirects I submitted?

well i wasnt aware you'd even found redirects in the same sites lol, anyone who does site:chase.com inurl:url=http can find those easily tho.
but yes in future you should attempt redirecting to a data: uri assuming it doesn't throw a corrupted content error

x1admin wrote:if redirect via js we accept xss

Interesting though since it's arguably not an XSS vulnerability on the website.

I see it as misinformation in fact as reporting the vulnerability to the website owner would trigger them to patch the open redirect vulnerability.