Hacking Swagger-UI - from XSS to account takeovers

We have reported more than 60 instances of this bug across a wide range of bug bounty programs including companies like Paypal, Atlassian, Microsoft, GitLab, Yahoo

Pratik Dabhi (@impratikdabhi) / X

Swagger-ui appears to require 'unsafe-eval' in CSP Headers · Issue #5817 · swagger-api/swagger-ui · GitHub

Kelvin Wanja on LinkedIn: #hacking #hacking #development #bugbounty #bugbountytips

The Bug Bounty Hunter – Telegram

Found +6 DomXSS at different programs (Hacking Swagger-UI), by Adham sayed (doosec101)

Bug Bounty Quick Wins: How to exploit XSS Issues on Swagger Instances., Jayesh Madnani posted on the topic

Found +6 DomXSS at different programs (Hacking Swagger-UI), by Adham sayed (doosec101)

How to Hack APIs in 2021 - Labs Detectify

Hacking Swagger-UI - from XSS to account takeovers

Hackevents FirstBlood - Live Hacker Challenge

Pratik Dabhi (@impratikdabhi) / X