Hacking Swagger-UI - from XSS to account takeovers

We have reported more than 60 instances of this bug across a wide range of bug bounty programs including companies like Paypal, Atlassian, Microsoft, GitLab, Yahoo

How I Found 3 XSS Types (Reflected, Blind Stored && DOM XSS) In One Program and Got $$$$, by Mustafa Adam Qamar El-Din

The Bug Bounty Hunter – Telegram

APIsec Resource Library

APIsec Resource Library

Swagger-ui appears to require 'unsafe-eval' in CSP Headers · Issue #5817 · swagger-api/swagger-ui · GitHub

The Bug Bounty Hunter – Telegram

Newsletter Archive Archives - API Security News

GitHub - rodolfomarianocy/Tricks-Web-Penetration-Tester: Web Application Penetration Testing

Found +6 DomXSS at different programs (Hacking Swagger-UI), by Adham sayed (doosec101)

GitHub - rodolfomarianocy/Tricks-Web-Penetration-Tester: Web Application Penetration Testing

How we made $120k bug bounty in a year with good automation

Found +6 DomXSS at different programs (Hacking Swagger-UI), by Adham sayed (doosec101)

How to Hack APIs in 2021 - Labs Detectify

Hacking Swagger-UI - from XSS to account takeovers