Loading video...

Video Failed to Load

Go Home

3,000$ Bug Bounty Reward from Microsoft Forms: Reflected XSS Vulnerability Writeup:

DarkWebInformer's profile picture

Dark Web Informer

222,084 subscribers

24,247 views • 6 months ago •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

0 Comments

No comments available

Comments from the original post will appear here

Related Videos

‼️ Leaking the email of any YouTube user for $10,000 Bug Bounty Writeup:
0:20

‼️ Leaking the email of any YouTube user for $10,000 Bug Bounty Writeup:

Dark Web Informer

44,839 views • 5 months ago

How to deliver reflected XSS via HTTP request smuggling vulnerability! 👇 Try this Practitioner lab now:
0:51

How to deliver reflected XSS via HTTP request smuggling vulnerability! 👇 Try this Practitioner lab now:

Web Security Academy

58,758 views • 17 days ago

Leaking the phone number of any Google user ($5k bounty) This vulnerability was submitted to Google's VRP program and awarded a $5,000 bounty. It has since been patched. Writeup:
1:48

Leaking the phone number of any Google user ($5k bounty) This vulnerability was submitted to Google's VRP program and awarded a $5,000 bounty. It has since been patched. Writeup:

Dark Web Informer

97,512 views • 6 months ago

[Bug Bounty] $3,000 Instagram delete highlight cover IDOR Credit: Write-up:
2:17

[Bug Bounty] $3,000 Instagram delete highlight cover IDOR Credit: Write-up:

Dark Web Informer

32,576 views • 1 year ago

I found 2 stored XSS vulnerabilities in ChatGPT. The XSS bug was the easy part, but sharing it required bypassing CSP, leveraging a mass assignment issue for client-side path traversal (thanks Critical Thinking - Bug Bounty Podcast) to force a request to a BFLA endpoint. 🧵 [1/5]
0:31

I found 2 stored XSS vulnerabilities in ChatGPT. The XSS bug was the easy part, but sharing it required bypassing CSP, leveraging a mass assignment issue for client-side path traversal (thanks Critical Thinking - Bug Bounty Podcast) to force a request to a BFLA endpoint. 🧵 [1/5]

Ron Masas

76,731 views • 2 years ago

What would you do with $16,000,000? Today, Usual is announcing the largest bug bounty in the history of the world: A $16,000,000 reward for discovering a single critical vulnerability in Usual's codebase. Hosted on Sherlock, in partnership with Nexus Mutual.
0:40

What would you do with $16,000,000? Today, Usual is announcing the largest bug bounty in the history of the world: A $16,000,000 reward for discovering a single critical vulnerability in Usual's codebase. Hosted on Sherlock, in partnership with Nexus Mutual.

SHERLOCK

3,818,685 views • 1 year ago

Integrity flow vulnerability in "microsoft teams" poll 3000$ bounty Sometimes, overlooked isuue can create significant vulnerability. In the "displayname" field, we send the name of the person we want the message to be send. #bugbounty
0:42

Integrity flow vulnerability in "microsoft teams" poll 3000$ bounty Sometimes, overlooked isuue can create significant vulnerability. In the "displayname" field, we send the name of the person we want the message to be send. #bugbounty

Moslem Haghighian

11,998 views • 3 years ago

🔥XSSTRON - Chromium-based browser for XSS search The browser will automatically check for Reflected, Stored and DOM XSS vulnerabilities in the background. Also supports POST requests. When a vulnerability is found, it will display it in a new window along with an exploitation example. Link to GitHub - 👀Check Out Old Tweets Of Today Cyber News #CyberSecurity #BugBounty #infosec #xss
0:21

🔥XSSTRON - Chromium-based browser for XSS search The browser will automatically check for Reflected, Stored and DOM XSS vulnerabilities in the background. Also supports POST requests. When a vulnerability is found, it will display it in a new window along with an exploitation example. Link to GitHub - 👀Check Out Old Tweets Of Today Cyber News #CyberSecurity #BugBounty #infosec #xss

Today Cyber News

34,216 views • 2 years ago

New writeup from ꙅɿɘƚɔɘqꙅ and I: we're finally allowed to disclose a vulnerability reported to Kia which would've allowed an attacker to remotely control almost all vehicles made after 2013 using only the license plate. Full disclosure:
1:55

New writeup from ꙅɿɘƚɔɘqꙅ and I: we're finally allowed to disclose a vulnerability reported to Kia which would've allowed an attacker to remotely control almost all vehicles made after 2013 using only the license plate. Full disclosure:

Sam Curry

344,668 views • 1 year ago

Responsible disclosure and community contributions to security are critical for safeguarding zkSync Era. We’re excited to announce that the Immunefi bug bounty reward has been increased to $1.1M, with all L2 assets now in scope. Help secure zkSync Era:
0:27

Responsible disclosure and community contributions to security are critical for safeguarding zkSync Era. We’re excited to announce that the Immunefi bug bounty reward has been increased to $1.1M, with all L2 assets now in scope. Help secure zkSync Era:

ZKsync

229,310 views • 3 years ago

Here goes nginx-quicburst (CVE-2026-42530), a new RCE in Nginx discovered by our security agent VEGA and demonstrated by Nebula Security. This is only the third NGINX vulnerability since 2014 to receive NGINX’s “major” severity rating. If you use Nginx 1.31 with QUIC enabled, we recommend upgrading to the latest version. This bug has been patched in the latest Nginx release. We will publish the technical writeup, including the ASLR bypass, on July 18 together with the previous nginx-poolslip writeup.
0:27

Here goes nginx-quicburst (CVE-2026-42530), a new RCE in Nginx discovered by our security agent VEGA and demonstrated by Nebula Security. This is only the third NGINX vulnerability since 2014 to receive NGINX’s “major” severity rating. If you use Nginx 1.31 with QUIC enabled, we recommend upgrading to the latest version. This bug has been patched in the latest Nginx release. We will publish the technical writeup, including the ASLR bypass, on July 18 together with the previous nginx-poolslip writeup.

Nebula Security

91,104 views • 1 month ago

Iranians from of Varamin (an hour drive from Tehran) have placed a bounty on the heads of Netanyahu and/or Trump. The reward is 100 kg of gold
1:14

Iranians from of Varamin (an hour drive from Tehran) have placed a bounty on the heads of Netanyahu and/or Trump. The reward is 100 kg of gold

Arya Yadeghaar (Backup)

64,875 views • 25 days ago

Over $100,000💵 for reporting for a bug🔥⚡️ Cyber samurai, you are officially invited on a journey for a bug-free future of finance! Are you ready to take on your armour and battle with us? #CrossFi Foundation launches the Bug Bounty⚡️ The reward structure is in line with the Warrior Code 🔹Over $100,000 – critical bugs 🔹Over $50,000 – huge 🔹$5,000-$50,000 – medium 🔹Up to $7,500 – low 🔁There are no limits! You can report as many bugs as you can find!!! Read more about the Bug Bounty program on the official CrossFi Foundation website Have you already started your Way of the Crypto Samurai? 📣Submit the bug in this form and get your rewards! #money $XFI #crypto #defi #fintech #finance #blockchain #card #visa #cryptocard #decentralized #crosschain #token #technology #innovation #earn #reward #warrior
0:56

Over $100,000💵 for reporting for a bug🔥⚡️ Cyber samurai, you are officially invited on a journey for a bug-free future of finance! Are you ready to take on your armour and battle with us? #CrossFi Foundation launches the Bug Bounty⚡️ The reward structure is in line with the Warrior Code 🔹Over $100,000 – critical bugs 🔹Over $50,000 – huge 🔹$5,000-$50,000 – medium 🔹Up to $7,500 – low 🔁There are no limits! You can report as many bugs as you can find!!! Read more about the Bug Bounty program on the official CrossFi Foundation website Have you already started your Way of the Crypto Samurai? 📣Submit the bug in this form and get your rewards! #money $XFI #crypto #defi #fintech #finance #blockchain #card #visa #cryptocard #decentralized #crosschain #token #technology #innovation #earn #reward #warrior

CrossFi

10,253 views • 2 years ago

🏃‍♂️NEW CHALLENGE BOUNTY🏃‍♀️ VERDUDOUS BY CURSED 63% FROM 0, ID: 86522520 REWARD: $50 (Should be easy right?) SAME RULES AS ALWAYS GOOD LUCK DEMONS👿
0:35

🏃‍♂️NEW CHALLENGE BOUNTY🏃‍♀️ VERDUDOUS BY CURSED 63% FROM 0, ID: 86522520 REWARD: $50 (Should be easy right?) SAME RULES AS ALWAYS GOOD LUCK DEMONS👿

Hqmy

18,239 views • 1 month ago

New video: dawgyg - WoH covered a lot, including: how AI-generated bug bounty reports are a burden on OSS (FFmpeg mentioned), transitioning from bug hunting to working in-house on an AppSec team, the early blackhat days, and multiple appearances of his cats. 30sec clip:
0:42

New video: dawgyg - WoH covered a lot, including: how AI-generated bug bounty reports are a burden on OSS (FFmpeg mentioned), transitioning from bug hunting to working in-house on an AppSec team, the early blackhat days, and multiple appearances of his cats. 30sec clip:

solst/ICE of Astarte

33,940 views • 5 months ago

Exploiting llama.cpp’s RPC Server - From Null Buffer to RCE Against PIE + Full RELRO + NX | CVE-2026-34159: The vulnerability is a one-line logic bug in the RPC server’s tensor deserialization pipeline. Youtube: Blog:
0:37

Exploiting llama.cpp’s RPC Server - From Null Buffer to RCE Against PIE + Full RELRO + NX | CVE-2026-34159: The vulnerability is a one-line logic bug in the RPC server’s tensor deserialization pipeline. Youtube: Blog:

NullSecurityX

19,539 views • 3 months ago

Charlie Kirk was shot from behind and no expert in any field can prove me wrong. The Evidence Bounty is now close to $3,000. Why hasn't the original video come forward? Visit and take up the challenge or boost the bounty to help get to the bottom of this.
1:17

Charlie Kirk was shot from behind and no expert in any field can prove me wrong. The Evidence Bounty is now close to $3,000. Why hasn't the original video come forward? Visit and take up the challenge or boost the bounty to help get to the bottom of this.

Crowdsource The Truth

46,645 views • 9 months ago

I said I'm going to publish a technical article on how to test newsletter subscription functionality for BAC/XSS, I'll just drop it here instead; before we jump into testing these "newsletter subscription" features, we need to find them; here's a dork I use to find them [ site: ("subscribe"|"newsletter"|"unsubscribe") ]... most hackers don't look into these features, so this is a good opportunity; you can find vulnerabilities like XSS, IDOR/BAC, and even SQLi. In some cases the form only asks for your email, no name, country, etc. That doesn't stop you from testing XSS, but it can make IDOR testing harder to spot... if the email you enter is reflected back on the page, that's a great vector to test for XSS.
4:07

I said I'm going to publish a technical article on how to test newsletter subscription functionality for BAC/XSS, I'll just drop it here instead; before we jump into testing these "newsletter subscription" features, we need to find them; here's a dork I use to find them [ site: ("subscribe"|"newsletter"|"unsubscribe") ]... most hackers don't look into these features, so this is a good opportunity; you can find vulnerabilities like XSS, IDOR/BAC, and even SQLi. In some cases the form only asks for your email, no name, country, etc. That doesn't stop you from testing XSS, but it can make IDOR testing harder to spot... if the email you enter is reflected back on the page, that's a great vector to test for XSS.

Gospel

12,744 views • 8 months ago

Codename MDASH is an agentic vulnerability discovery and remediation system built to help teams find issues, move faster on fixes, and create secure code from the start. Coming soon to GitHub Copilot CLI and the Microsoft Defender portal.
3:12

Codename MDASH is an agentic vulnerability discovery and remediation system built to help teams find issues, move faster on fixes, and create secure code from the start. Coming soon to GitHub Copilot CLI and the Microsoft Defender portal.

Microsoft Developer

10,952 views • 1 month ago