Member-only story
What Real HackerOne XSS Reports Teach You That Tutorials Don’t
I went through publicly disclosed XSS reports from HackerOne, GitLab, LinkedIn, Apple and more — here’s the pattern behind every single one
So far in this series, we’ve covered recon, IDOR, Business Logic bugs, Subdomain Takeovers, Rate Limiting, and File Uploads. This article is a bit different — instead of a pure methodology, we’re going to pull apart real, publicly disclosed XSS reports and extract the exact pattern each one relied on. Tutorials teach you `<script>alert(1)</script>`. Real bugs rarely look like that.
Cross-site Scripting is still, by a huge margin, the most commonly reported bug class on HackerOne — ahead of CSRF, SQLi, IDOR, and SSRF combined, according to public disclosure data. But most of the still-unpatched, bounty-eligible XSS today isn’t the obvious kind. It’s hiding in the gaps between “the input is sanitized” and “the output is actually safe.”
Pattern 1: Third-party embeds reflecting into the DOM
One of HackerOne’s own disclosed reports describes a reflected XSS on www.hackerone.com and resources.hackerone.com, found through a Wistia embed code. The vulnerability wasn’t in HackerOne’s own code — it was in how…
