Some unusual ideas - please evaluate

[Egidijus Gecas]

Hi All,

As bug bounties get more and more attention how valuable for a smart hunter would be the following domains

en-gb.uk
webstatic.co.uk
recaptcha.uk


For instance - crafting XSS, downgrading the SRI policies, cookie smuggling etc, perhaps someone can suggest other possible ways to establish vulnerability threads? (Only ethical please)

 

[jazzc]

Nothing from what you mentioned has anything to do with these domains and bug hunting, so...

 

[Egidijus Gecas]

Are you sure?
They all can be utilised in my opinion, as often look same as the part of the page route, and are perfect for crafting XSS payloads.

 

[jazzc]

Are you sure?

Well, I was doing XSS back in the early 00s, so I have an idea

 

[Egidijus Gecas]

Note that XSS is still the top 1 vulnerability
Ultimately it can contribute to many, as -
SSRF, cache poisoning, malicious js or Web workers injection, http2 weaknesses etc

Hope to hear some thoughts if there are areas more rewarding than others