# Interesting XSS

While testing the signup functionalities, I tried to pass XSS payloads in the "First name" & "Last name" fields. However, the filtering was very effective and didn't allow me to enter special characters.

Now I thought of testing the same in their mobile application (Android). \
I entered : ">\<script>alert(1)\</script> in the  "First name" & "Last name" fields.\
It accepted the input and I could signup.

But throughout the application the payload was not executing.\
So I went back to the Web App and logged in with the account I signed up with on the android app.\
The payload was still not executing even on the profile page. Even if it did, it would be considered as self XSS because it would only be possible on authenticated endpoints.

Now I thought how my user data gets used externally, and after some time it occurred to me that this may be done by the website by using APIs.\
So I went to <https://api.target.com> and boom💥 the alert box popped up right away.

The impact in this case is that whenever an API call is made externally, the XSS is executed on the external system. I explained the impact and the report got accepted as valid. ✨

PS: I could have used blind XSS payloads pointing towards my server to escalate the impact but back then I didn't know as much.😅


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://utkarsh24122.gitbook.io/findings/xss/interesting-xss.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.