30-07-26, 07:29 AM
I discovered a stored XSS vulnerability on the web side of Sonoyuncu.com that is triggered when the /ben endpoint (profile page) is accessed, and I'm opening this thread to sell it.
What can you do with this stored XSS?
- You can show the user who visits https://sonoyuncu.com.tr/ben whatever you want, redirect them to your own site, completely change the page structure, send their active information and cookies wherever you want; in short, you can manage everything that happens on the client side. It doesn't matter which browser you use; you only need to learn the login information for that account once. After that, even if they change their password or enable 2FA, this will always be triggered.
Preview
Price:
$150
Payment Method:
Crypto - IBAN
Slot 1/1
Contact:
[email protected]
pgp key: http://n63ite5off46lfh7qei4uhkvttrgvpve7...vd6JGFVkau
What can you do with this stored XSS?
- You can show the user who visits https://sonoyuncu.com.tr/ben whatever you want, redirect them to your own site, completely change the page structure, send their active information and cookies wherever you want; in short, you can manage everything that happens on the client side. It doesn't matter which browser you use; you only need to learn the login information for that account once. After that, even if they change their password or enable 2FA, this will always be triggered.
Preview
Price:
$150
Payment Method:
Crypto - IBAN
Slot 1/1
Contact:
[email protected]
pgp key: http://n63ite5off46lfh7qei4uhkvttrgvpve7...vd6JGFVkau