[๖ۣۜAlexander]

I don't think anyone saw this one coming.

Didn't saw this coming, did you?

[Gee4rce]

@Lozab (OP):
Very nice find of yours, Congrats!
Sadly yahoo will pay no money for finds, instead you get a yahoo T-Shirt for free, so i would keep it 0day if i were you.
Would not suggest it to send around or show it to anybody else,- especially not HF Members ;)

@All others:
Nice finds (congratz also to Smiegles on the bing one!) and funny to read, but i'm not shure though if the hackforums ones are real, but still funny to read, lol ^^

@byRadial:
Yes this thread indeed is turning out very interesting :3
Greets, Gee.

P.S.:

Google, Main search API... DOM-Based XSS - Persistant and kept 0day for about 1,5 years.

[img]http://img577.imageshack.us/img577/2153/qr9b.png[/img]

Greets, Gee.

[webdev77]

@Lozab (OP):
Very nice find of yours, Congrats!
Sadly yahoo will pay no money for finds, instead you get a yahoo T-Shirt for free, so i would keep it 0day if i were you.
Would not suggest it to send around or show it to anybody else,- especially not HF Members ;)

@All others:
Nice finds (congratz also to Smiegles on the bing one!) and funny to read, but i'm not shure though if the hackforums ones are real, but still funny to read 🙂

Greets, Gee.

P.S.:

Google, Main search API... DOM-Based XSS - Persistant and 0day.

[img]http://img577.imageshack.us/img577/2153/qr9b.png[/img]

Greets, Gee.

Let us know when you receive your award from google if that's real.

[133720]

Nice found .
Very Good in XSS.
I need to learn more about the XSS from you.

[Lozab]

bing, no problem
https://i.imgur.com/qlfb8XU.png

Spoiler (Click to View)
XSS^
@Gee4rce

I will keep this as a 0day, since Yahoo haven't responded to me if they reward peeps.

and Really nice find bro. :O

[EXPLICIT CONTENT]

Since, we all are bragging about our 1337 0-Dayz, here we go
Spoiler (Click to View)
Yup, its persistant XSS, got multiple of them, all are non reported :P

[Lozab]

Since, we all are bragging about our 1337 0-Dayz, here we go
Spoiler (Click to View)
Yup, its persistant XSS, got multiple of them, all are non reported :P

Isn't this XSS on 1337day?

actersss

[EXPLICIT CONTENT]

Isn't this XSS on 1337day?

actersss

It is, and also in the Deepweb, but there are multiple ones, and soon there will be one for sale here, as I am in need for some cash

[Lozab]

It is, and also in the Deepweb, but there are multiple ones, and soon there will be one for sale here, as I am in need for some cash

Oh, So its one of those stored XSS's in paypal right?

[EXPLICIT CONTENT]

Oh, So its one of those stored XSS's in paypal right?

It is stored and it affects two sites, means you kinda can "infect" another one by interacting with other users, with sending money or via other ways.
Once they login, the vector will execute and they are fucked (nah, depends on the Vector)

[HolyGates]

daym nice find man! yahoo got rocked.

[eiqht]

Nice find. Have you decided on reporting it yet?

[Lozab]

Nice find. Have you decided on reporting it yet?

Well I'm currently waiting for there Response.

but some people say Yahoo doesn't reward people who find Exploits, not sure about that.

[TheKingOfArabs]

Well I'm currently waiting for there Response.

but some people say Yahoo doesn't reward people who find Exploits, not sure about that.

I'm pretty sure they send you a yahoo shirt.

Google and Facebook reward $500.

[EXPLICIT CONTENT]

I'm pretty sure they send you a yahoo shirt.

Google and Facebook reward $500.

Google's minimum is 100$, and Facebook's minimum reward is 500, you get more than 500$ for an XSS ;)